ALPINE-CVE-2026-119741: High severity alpine/rsync vulnerability

Q: Which deployments are exposed to remote exploitation?

Public rsync daemon modules that allow unauthenticated clients to pull data are exposed. An attacker can trigger the issue remotely as a malicious receiver during a delta transfer.

Q: What does an attacker need to do to cause the denial of service?

The attacker must supply weak checksums that collide with consecutive rolling windows while supplying non-matching strong checksums. This causes unbounded strong-checksum work in the sender's hash_search() processing.

Q: What is the operational impact?

The vulnerability can exhaust CPU on the rsync sender, including across concurrent connections, causing a denial of service. The supplied severity vector indicates availability impact only, with no stated confidentiality or integrity impact.

Q: Are installations running version 3.5.2 affected?

The issue affects rsync versions before 3.5.2. Systems running rsync 3.5.2 or later are not identified as affected by the provided data.

Published Nov 3, 2026

Updated

rsync before 3.5.2 contains a denial of service vulnerability in the delta-transfer sender's hashsearch() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.

Affected Software

1 affected componentFixes available

alpine/rsync<3.5.2-r0

3.5.2-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade alpine/rsync to a version that resolves this vulnerability.
Fixed in 3.5.2-r0

Event History

Nov 3, 2026

CVE Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

Public rsync daemon modules that allow unauthenticated clients to pull data are exposed. An attacker can trigger the issue remotely as a malicious receiver during a delta transfer.

What does an attacker need to do to cause the denial of service?

The attacker must supply weak checksums that collide with consecutive rolling windows while supplying non-matching strong checksums. This causes unbounded strong-checksum work in the sender's hash_search() processing.

What is the operational impact?

The vulnerability can exhaust CPU on the rsync sender, including across concurrent connections, causing a denial of service. The supplied severity vector indicates availability impact only, with no stated confidentiality or integrity impact.

Are installations running version 3.5.2 affected?

The issue affects rsync versions before 3.5.2. Systems running rsync 3.5.2 or later are not identified as affected by the provided data.

ALPINE-CVE-2026-119741: High severity alpine/rsync vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

What does an attacker need to do to cause the denial of service?

What is the operational impact?

Are installations running version 3.5.2 affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

What does an attacker need to do to cause the denial of service?

What is the operational impact?

Are installations running version 3.5.2 affected?