---
id: CVE-2026-119741
title: rsync < 3.5.2 Denial of Service via hash_search() Checksum Collisions
summary: >-
  rsync before 3.5.2 contains a denial of service vulnerability in the
  delta-transfer sender's hash_search() in match.c that allows malicious
  receivers to trigger unbounded strong-checksum work at consecutive offsets.
  Unauthenticated attac…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-407
vendor: RsyncProject
product: rsync
affected:
  - rsync <= 3.5.1
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-03T16:43:41.930734Z'
published: '2026-11-03'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T14:15:55.669Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119741'
references:
  - url: 'https://github.com/RsyncProject/rsync/releases/tag/v3.5.2'
    label: Fixed Release Tag
  - url: 'https://github.com/RsyncProject/rsync/pull/1132'
    label: 'Pull Request #1132'
  - url: >-
      https://github.com/RsyncProject/rsync/commit/a7404a9a633cff28ee1602f328b9c3fa69cdbd04
    label: Patch Commit
  - url: >-
      https://github.com/RsyncProject/rsync/blob/a7404a9a633cff28ee1602f328b9c3fa69cdbd04/testsuite/hashsearch-collision-skip_test.py
  - url: >-
      https://www.vulncheck.com/advisories/rsync-through-3.5.1-denial-of-service-via-hash-search-checksum-collisions
    label: >-
      VulnCheck Advisory: rsync through 3.5.1 Denial of Service via
      hash_search() Checksum Collisions
tags:
  - cve.org
epss: 0.00627
epssPercentile: 0.50313
ingestedAt: '2026-11-05T20:33:06.747Z'
---

## Overview

rsync before 3.5.2 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.

## Affected

- `rsync <= 3.5.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.