{"id":"CVE-2026-119741","kind":"vulnerability","aliases":["CVE-2026-119741"],"related":[],"title":"rsync: crafted checksums let a client exhaust sender CPU","description":"rsync through 3.5.1 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.","summary":"rsync through 3.5.1 has a flaw in the delta-transfer sender's hash_search() in match.c where a malicious receiver can force unbounded strong-checksum work. An unauthenticated attacker pulling from a public rsync daemon module can exhaust sender CPU across concurrent connections, causing denial of service.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","package","rsync","self-hosted"],"not_affected_if":["auth-required","no-public-daemon","ssh-only"],"how_to_check":"- Check the installed version with `rsync --version`, and compare it against the fixed release in the product ranges.\n- Look for rsync daemon modules (`rsyncd.conf`) exposed to the internet and reachable without authentication.","fix":"- rsync: move to a release newer than `3.5.1` (fixed version not stated in the sources; check the linked patch).","status":"open","published_at":"2026-11-03T16:17:21+00:00","first_seen_at":"2026-11-03T16:21:42+00:00","triaged_at":"2026-11-03T16:23:43+00:00","updated_at":"2026-11-03T16:23:43+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T16:23:43Z","model":"claude-haiku-5-5","output":{"fix":"- rsync: move to a release newer than `3.5.1` (fixed version not stated in the sources; check the linked patch).","reach":"internet","title":"rsync: crafted checksums let a client exhaust sender CPU","impact":"medium","summary":"rsync through 3.5.1 has a flaw in the delta-transfer sender's hash_search() in match.c where a malicious receiver can force unbounded strong-checksum work. An unauthenticated attacker pulling from a public rsync daemon module can exhaust sender CPU across concurrent connections, causing denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["rsync","self-hosted","linux"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"sender CPU exhausted, service becomes unavailable to other clients","analyst_note":"Confirm the fixed rsync version from the linked patch and the vulncheck advisory; the sources do not name it.","how_to_check":"- Check the installed version with `rsync --version`, and compare it against the fixed release in the product ranges.\n- Look for rsync daemon modules (`rsyncd.conf`) exposed to the internet and reachable without authentication.\n- unknown for any further detail the sources do not give.","plain_action":"","needs_analyst":true,"not_affected_if":["auth-required","ssh-only","no-public-daemon"],"who_is_affected":"Systems running rsync as a server, specifically a public daemon module that accepts unauthenticated pulls, are exposed. Plain rsync client use over SSH or private daemon modules that require authentication is less exposed. unknown for the exact default configuration.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000726,"input_tokens":4208,"output_tokens":611,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119741':12A,15A '-2026':11A,14A '3.5.1':24B,73C 'across':64B,131C 'allow':92C 'attack':52B,106C 'caus':67B 'checksum':3A,48B,100C,116C,127C 'client':6A 'collid':117C 'concurr':65B,132C 'connect':66B,133C 'consecut':103C,119C 'contain':74C 'cpu':9A,63B,130C 'craft':2A 'cve':10A,13A 'daemon':58B,111C 'delta':31B,83C 'delta-transf':30B,82C 'denial':68B,76C 'exhaust':7A,61B,128C 'flaw':27B 'forc':44B 'hash':35B,87C 'host':21B 'let':4A 'linux':16B 'malici':41B,93C 'match':125C 'match.c':38B,90C 'modul':59B,112C 'non':124C 'non-match':123C 'offset':104C 'packag':17B 'plus':122C 'public':56B,110C 'pull':53B,107C 'receiv':42B,94C 'roll':120C 'rsync':1A,18B,22B,57B,71C 'search':36B,88C 'self':20B 'self-host':19B 'sender':8A,33B,62B,85C,129C 'servic':70B,78C 'strong':47B,99C,126C 'strong-checksum':46B,98C 'suppli':114C 'transfer':32B,84C 'trigger':96C 'unauthent':51B,105C 'unbound':45B,97C 'vulner':79C 'weak':115C 'window':121C 'work':49B,101C","nicknames":[],"mitigations":[],"who_affected":"Systems running rsync as a server, specifically a public daemon module that accepts unauthenticated pulls, are exposed. Plain rsync client use over SSH or private daemon modules that require authentication is less exposed. unknown for the exact default configuration.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","linux","package","rsync","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-03T16:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119741","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119741","severity":null,"published_at":"2026-11-03T16:17:21+00:00","modified_at":"2026-11-03T16:17:21+00:00","first_seen_at":"2026-11-03T16:21:42+00:00","fetched_at":"2026-11-03T16:21:42+00:00","note":null}],"documents":[{"id":58807,"url":"https://github.com/RsyncProject/rsync/commit/a7404a9a633cff28ee1602f328b9c3fa69cdbd04","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58808,"url":"https://www.vulncheck.com/advisories/rsync-through-3.5.1-denial-of-service-via-hash-search-checksum-collisions","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}