AZL-112646: CVE-2026-119741 affecting package rsync 3.5.1-1
rsync through 3.5.1 contains a denial of service vulnerability in the delta-transfer sender's hashsearch() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.
Affected Software
Event History
Frequently Asked Questions
Which rsync deployments are exposed to unauthenticated exploitation?
Public rsync daemon modules that permit unauthenticated clients to pull data are exposed. The malicious client acts as a receiver and causes the sending side to perform excessive checksum work.
What does an attacker need to send to trigger the denial of service?
The attacker needs to provide weak checksums that collide with consecutive rolling windows while providing strong checksums that do not match. This drives unbounded strong-checksum processing in the sender's hash_search() path.
What is the likely operational impact?
The issue can exhaust CPU on the rsync sender. Concurrent malicious connections can amplify the CPU consumption and deny service to legitimate transfers.