rsync before 3.5.2 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.
CVE-2026-119741
CVSS base score
7.5 (v3.1)
Severity
HIGH
Attack vector
Network
Weakness
CWE-407
Last modified
November 4, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
samba rsync
References
- github.com Patch
- github.com Patch
- github.com Issue Tracking, Patch
- github.com
- www.vulncheck.com Third Party Advisory