CPU Exhaustion Vulnerability (CVE‑2026‑119741) in rsync 3.5.1 and Earlier Allows Denial‑of‑Service
What Happened — The open‑source file‑synchronisation utility rsync released version 3.5.2, which patches CVE‑2026‑119741. The flaw resides in hash_search() where a malicious receiver can feed colliding weak checksums and mismatched strong checksums, forcing the sender to compute costly strong checksums indefinitely. With a few concurrent connections the server’s CPU can be saturated, resulting in a denial‑of‑service condition. All rsync releases up to 3.5.1 are affected. The new release also adds --nice and --no‑nice options to let clients lower CPU and I/O priority, helping to protect critical workloads from being starved.
Why It Matters for Trust & Control Assurance — It highlights the need for continuous patch management and evidence of resource‑usage controls that map to availability‑related control objectives.
Who Is Affected — SaaS platforms, cloud‑infrastructure providers, DevOps teams, and any organization that runs a public rsync daemon for backups or mirroring.
Recommended Actions — Upgrade all rsync instances to 3.5.2 or later, enable the new priority options where appropriate, restrict public daemon access, and add CPU‑usage monitoring to detect abnormal checksum‑generation activity. Source: Help Net Security
Technical Notes — Attack vector: crafted checksum payload sent over the rsync protocol; CVE‑2026‑119741 (algorithmic‑complexity denial‑of‑service); CVSS 4.0 = 8.7 (critical). The vulnerability impacts availability only; no data confidentiality breach is reported. Source: Help Net Security