CVE-2026-119741

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.2

Description A denial of service issue exists in the delta-transfer sender's hash search() function within match.c. Unauthenticated attackers pulling from a public daemon module can trigger unbounded strong-checksum computations at consecutive offsets by supplying weak checksums that collide with consecutive rolling windows along with non-matching strong checksums. This process can exhaust the sender's CPU resources, particularly when multiple concurrent connections are established.

Recommendations Update to a version newer than 3.5.1.