DEBIAN-CVE-2026-119741: High severity debian/rsync vulnerability
rsync through 3.5.1 contains a denial of service vulnerability in the delta-transfer sender's hashsearch() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.
Affected Software
Event History
Frequently Asked Questions
Which rsync deployments are exposed to this denial of service?
Deployments running rsync through 3.5.1 are exposed when they offer a public daemon module that unauthenticated clients can pull from. The issue affects the sender during delta transfer processing.
What must an attacker do to trigger the issue?
An attacker needs network access to pull from a public rsync daemon module. They can provide weak checksums that collide with consecutive rolling windows while supplying non-matching strong checksums, causing excessive sender CPU work.
What is the practical impact of exploitation?
A malicious receiver can exhaust CPU on the rsync sender, particularly by using concurrent connections. The reported impact is denial of service rather than loss of confidentiality or integrity.