CVE-2026-119741 with a CVSS score of 8.7 is an inefficient algorithmic complexity vulnerability in rsync's hash_search() function in match.c. The flaw occurs in the checksum matching loop used when a receiving side sends block checksums to a sender. A malicious receiver can transmit weak rolling checksums that repeatedly collide with the sender's current window while pairing them with strong checksums that do not match, forcing the sender to repeatedly compute strong checksums that fail. Because this operation is CPU-intensive, a few simultaneous connections can consume the server's processing resources. The attack can be performed by a connecting client, and when a public daemon module is exposed, an unauthenticated user can trigger it simply by pulling files. The impact is primarily availability, as the server's CPU resources can be exhausted, degrading or denying service to other operations without affecting data confidentiality or integrity.
We recommend you to update rsync to version 3.5.2 or later.[/subscribe_to_unlock_form]
CVE-2026-119741 with a CVSS score of 8.7 is an inefficient algorithmic complexity vulnerability in rsync's hash_search() function in match.c. The flaw occurs in the checksum matching loop used when a receiving side sends block checksums to a sender. A malicious receiver can transmit weak rolling checksums that repeatedly collide with the sender's current window while pairing them with strong checksums that do not match, forcing the sender to repeatedly compute strong checksums that fail. Because this operation is CPU-intensive, a few simultaneous connections can consume the server's processing resources. The attack can be performed by a connecting client, and when a public daemon module is exposed, an unauthenticated user can trigger it simply by pulling files. The impact is primarily availability, as the server's CPU resources can be exhausted, degrading or denying service to other operations without affecting data confidentiality or integrity.
We recommend you to update rsync to version 3.5.2 or later.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]