{"id":"CVE-2026-119741","title":"rsync < 3.5.2 Denial of Service via hash_search() Checksum Collisions","summary":"rsync before 3.5.2 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attac…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-407"],"vendor":"RsyncProject","product":"rsync","affected":["rsync <= 3.5.1"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-11-03T16:43:41.930734Z"},"published":"2026-11-03","updated":"2026-11-04","sourceUpdated":"2026-11-04T14:15:55.669Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119741","references":[{"url":"https://github.com/RsyncProject/rsync/releases/tag/v3.5.2","label":"Fixed Release Tag"},{"url":"https://github.com/RsyncProject/rsync/pull/1132","label":"Pull Request #1132"},{"url":"https://github.com/RsyncProject/rsync/commit/a7404a9a633cff28ee1602f328b9c3fa69cdbd04","label":"Patch Commit"},{"url":"https://github.com/RsyncProject/rsync/blob/a7404a9a633cff28ee1602f328b9c3fa69cdbd04/testsuite/hashsearch-collision-skip_test.py"},{"url":"https://www.vulncheck.com/advisories/rsync-through-3.5.1-denial-of-service-via-hash-search-checksum-collisions","label":"VulnCheck Advisory: rsync through 3.5.1 Denial of Service via hash_search() Checksum Collisions"}],"tags":["cve.org"],"epss":0.00627,"epssPercentile":0.50313,"ingestedAt":"2026-11-05T20:33:06.747Z","slug":"CVE-2026-119741","body":"## Overview\n\nrsync before 3.5.2 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.\n\n## Affected\n\n- `rsync <= 3.5.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}