Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
rsync before 3.5.2 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
Rsync 3.5.2 addresses CVE-2026-119741, fixes interrupted file transfers, and introduces new options for process priorities and symlink handling. https://linuxiac.com/rsync-3-5-2-fixes-security-vulnerability-improves-interrupted-transfers/ #OpenSource
Rsync 3.5.2 fixes CVE-2026-119741: a malicious receiver could make the sender perform excessive checksum calculations. The release also fixes bugs affecting interrupted transfers and file creation. #Rsync https://en.hacks.gr/to-rsync-3-5-2-diorthonei-provlima-poy-epetrepe-se-kakovoylo-paralipti-na-prokalei-epanalamvanomenoys-ypologismoys/ https://t.co/e0Q5T2fkVR
🚨High - rsync CPU DoS via hash_search() Strong-Checksum Amplification (CVE-2026-119741) rsync’s delta-transfer sender hash_search() in match.c can be driven into unbounded strong-checksum computations at consecutive offsets when a malicious receiver supplies colliding weak rolling checksums with non-matching strong checksums. Unauthenticated attackers pulling from a public rsync daemon module can exhaust CPU, especially with many concurrent connections. 👉Affected: rsync <= 3.5.1
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | samba | rsync | - | - | - |