CVE-2026-119741: rsync through 3.5.1 Denial of Service via hash_search() Checksum Collisions

Q: Which deployments are exposed to remote exploitation?

Public rsync daemon modules that allow unauthenticated clients to pull data are exposed. A malicious receiver can open concurrent connections and consume CPU on the sender.

Q: What must an attacker send to trigger the issue?

The attacker must provide weak checksums that collide with consecutive rolling windows, while supplying strong checksums that do not match. This causes the sender's hash_search() processing to perform unbounded strong-checksum work.

Q: What is the operational impact?

The vulnerability affects availability by exhausting CPU on the rsync sender. The provided vector indicates no confidentiality or integrity impact.

Published Nov 3, 2026

Updated

rsync through 3.5.1 contains a denial of service vulnerability in the delta-transfer sender's hashsearch() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.

Affected Software

5 affected componentsFixes available

Samba rsync<=3.5.1

debian/rsync*

debian/rsync<=3.2.7-1+deb12u6, <=3.2.7-1+deb12u5, <=3.4.1+ds1-5+deb13u4, <=3.5.0+ds1-0+deb13u1, <=3.5.1+ds1-2

3.5.2+ds1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/rsync to a version that resolves this vulnerability.
Fixed in 3.5.2+ds1-1

Event History

Nov 3, 2026

CVE Published

via MITRE·03:26 PM

Data Sourced

via MITRE·03:26 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

RemedyDescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·04:17 PM

Affected Software

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

Public rsync daemon modules that allow unauthenticated clients to pull data are exposed. A malicious receiver can open concurrent connections and consume CPU on the sender.

What must an attacker send to trigger the issue?

The attacker must provide weak checksums that collide with consecutive rolling windows, while supplying strong checksums that do not match. This causes the sender's hash_search() processing to perform unbounded strong-checksum work.

What is the operational impact?

The vulnerability affects availability by exhausting CPU on the rsync sender. The provided vector indicates no confidentiality or integrity impact.

CVE-2026-119741: rsync through 3.5.1 Denial of Service via hash_search() Checksum Collisions

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

What must an attacker send to trigger the issue?

What is the operational impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

What must an attacker send to trigger the issue?

What is the operational impact?