CVE-2026-119741 rsync < 3.5.2 Denial of Service via hash_search() Checksum Collisions

What is CVE-2026-119741?

CVE-2026-119741 is a high-severity vulnerability in Rsync, published on 3 Nov 2026.

Official description

rsync before 3.5.2 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.

Weakness: CWE-407

Which versions are affected by CVE-2026-119741?

It affects 1 product.

Products include Rsync.

How do I fix CVE-2026-119741?

Upgrade to a fixed version.

Is CVE-2026-119741 being exploited?

There is no known exploitation of CVE-2026-119741 in the wild and no public exploit code.

Other vulnerabilities in Rsync

• CVE-2017-15994 rsync 3.1.3-development before 2017-10-24 mishandles archaic checksums, which makes it easier for remote attackers to bypass intended access restrictions. Critical 9.8
• CVE-2026-53790 rsync < 3.5.0 Command Injection via Multiple Code Paths Critical 9.2
• CVE-2026-70460 rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink Critical 9.2
• CVE-2026-53791 rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header Critical 9.1
• CVE-2026-53793 rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode Critical 9.1

All Rsync vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-119741, AZL-112646, BELL-CVE-2026-119741, DEBIAN-CVE-2026-119741, ECHO-c4a8-6894-2dcd, GHSA-56w4-j8c7-xvrw and 2 more.