Log in Start free

Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck

CVE-2026-119741rsync < 3.5.2 Denial of Service via hash_search() Checksum Collisions

High 7.5

In plain English

A high-severity security flaw in rsync from RsyncProject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 49.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

rsync before 3.5.2 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24rsync3.5.2-r0ALPINE-CVE-2026-119741
Debian:12rsyncno fix listedDEBIAN-CVE-2026-119741
Debian:13rsyncno fix listedDEBIAN-CVE-2026-119741
Debian:14rsyncno fix listedDEBIAN-CVE-2026-119741
Ubuntu:22.04:LTSrsyncno fix listedUBUNTU-CVE-2026-119741
Ubuntu:24.04:LTSrsyncno fix listedUBUNTU-CVE-2026-119741
Ubuntu:26.04:LTSrsyncno fix listedUBUNTU-CVE-2026-119741
Ubuntu:26.10rsyncno fix listedUBUNTU-CVE-2026-119741

Affected products (as reported)

VendorProductVersions
RsyncProject rsync 0 – through 3.5.1

Weakness: CWE-407 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References