Live › vulnerability › CVE-2026-119741
rsync through 3.5.1 has a flaw in the delta-transfer sender's hash_search() in match.c where a malicious receiver can force unbounded strong-checksum work. An unauthenticated attacker pulling from a public rsync daemon module can exhaust sender CPU across concurrent connections, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Systems running rsync as a server, specifically a public daemon module that accepts unauthenticated pulls, are exposed. Plain rsync client use over SSH or private daemon modules that require authentication is less exposed. unknown for the exact default configuration.
No product ranges from the sources yet.
rsync --version, and compare it against the fixed release in the product ranges.rsyncd.conf) exposed to the internet and reachable without authentication.3.5.1 (fixed version not stated in the sources; check the linked patch).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
rsync through 3.5.1 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.
This page as .md · .json · in your agent: get_signal("CVE-2026-119741")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.