Vulnerabilities · 4h ago

rsync 3.5.2 closes unauthenticated CPU exhaustion flaw

Help Net Security reports that rsync 3.5.2 fixes CVE-2026-119741, an unauthenticated CPU-exhaustion flaw affecting versions through 3.5.1. A client can trigger it without an account on a public daemon module; the risk is server availability, not file confidentiality or integrity.

Rsync saves bandwidth by matching blocks of data. A malicious client can send weak checksums that repeatedly look like matches, then fail the stronger check. That forces rsync to redo costly comparisons without finding reusable data; a few connections can consume the server’s CPU.

Version 3.5.2 also adds controls to lower transfer scheduling priority, but those do not prevent the checksum abuse. If a public rsync host also runs backups or software mirrors, CPU exhaustion can disrupt those services even though the flaw does not expose file contents.

CVE-2026-119741

NVD KEV

CVSS 7.5 HIGH: rsync through 3.5.1 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in…

Timeline

Nov 4 Reported by Help Net Security

Sources

1 source covering this story

Help Net Security Nov 4
Open-source file sync tool rsync 3.5.2 fixes a CPU exhaustion flaw - Help Net Security
sync 3.5.2 fixes a flaw that let an unauthenticated client exhaust a server’s CPU, and adds --nice CPU and disk priority controls.

Entities

CVE-2026-119741

Part of the PlainSec briefing for 2026-11-04

Editions

Briefing for 2026-11-04

Vulnerabilities · 4h agorsync 3.5.2 closes unauthenticated CPU exhaustion flawHelp Net Security reports that rsync 3.5.2 fixes CVE-2026-119741, an unauthenticated CPU-exhaustion flaw affecting versions through 3.5.1. A client can trigger it without an account on a public daemon module; the risk is server availability, not file confidentiality or integrity.Rsync saves bandwidth by matching blocks of data. A malicious client can send weak checksums that repeatedly look like matches, then fail the stronger check. That forces rsync to redo costly comparisons without finding reusable data; a few connections can consume the server’s CPU.Version 3.5.2 also adds controls to lower transfer scheduling priority, but those do not prevent the checksum abuse. If a public rsync host also runs backups or software mirrors, CPU exhaustion can disrupt those services even though the flaw does not expose file contents.