CVE-2026-119741
CVSS 7.5 HIGH: rsync through 3.5.1 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in…
Vulnerabilities & Exploits
Help Net Security reports that rsync 3.5.2 fixes CVE-2026-119741, an unauthenticated CPU-exhaustion flaw affecting versions through 3.5.1. A client can trigger it without an account on a public daemon module; the risk is server availability, not file confidentiality or integrity.
Rsync saves bandwidth by matching blocks of data. A malicious client can send weak checksums that repeatedly look like matches, then fail the stronger check. That forces rsync to redo costly comparisons without finding reusable data; a few connections can consume the server’s CPU.
Version 3.5.2 also adds controls to lower transfer scheduling priority, but those do not prevent the checksum abuse. If a public rsync host also runs backups or software mirrors, CPU exhaustion can disrupt those services even though the flaw does not expose file contents.
1 source · 4h ago
CVSS 7.5 HIGH: rsync through 3.5.1 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in…
Help Net Security
Open-source file sync tool rsync 3.5.2 fixes a CPU exhaustion flaw - Help Net Security
sync 3.5.2 fixes a flaw that let an unauthenticated client exhaust a server’s CPU, and adds --nice CPU and disk priority controls.
originalPart of the PlainSec briefing for 2026-11-04
Every edition of this story: rsync 3.5.2 closes unauthenticated CPU exhaustion flaw