Vulnerability in Rsyncproject Rsync
CVE-2026-119741
rsync through 3.5.1 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/RsyncProject/rsync/pull/1132 (issue-tracking, Patch, patch, Issue Tracking)
- github.com/RsyncProject/rsync/commit/a7404a9a633cff28ee1602f328b9c3fa69cdbd04 (Patch, patch)
- github.com/RsyncProject/rsync (Product, product)
- github.com/RsyncProject/rsync/blob/a7404a9a633cff28ee1602f328b9c3fa69cdbd04/tes… (technical-description, Patch)
- www.vulncheck.com/advisories/rsync-through-3.5.1-denial-of-service-via-hash-sea… (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2026-119741?
- CVE-2026-119741 is a high-severity vulnerability in Rsyncproject Rsync, classified under Inefficient Algorithmic Complexity. CVSS score: 7.5/10. Published 2026-11-03.
- How severe is CVE-2026-119741?
- High severity. CVSS v3 base score is 7.5 out of 10.