New High-Severity Denial of Service Vulnerability in Rsync

## Overview A new high-severity vulnerability, CVE-2026-119741, affects Rsync versions prior to 3.5.2. This flaw allows unauthenticated attackers to exploit the delta-transfer sender's hash_search() function. The vulnerability can lead to a denial of service (DoS) by exhausting CPU resources on the sender side. ## Technical Details The issue resides in the hash_search() function within match.c. Attackers can leverage this vulnerability by pulling from a public daemon module. They can supply weak checksums that collide with consecutive rolling windows and non-matching strong checksums. This results in unbounded strong-checksum processing, which can significantly degrade performance. The CVSS score for this vulnerability is 8.7, indicating a high severity level. ## Impact Successful exploitation of this vulnerability can cause the sender's CPU to become overwhelmed, especially under concurrent connections. This can lead to service outages and degraded performance for legitimate users. Organizations using affected versions of Rsync should be aware of the potential for significant operational disruption. ## Mitigation To protect against CVE-2026-119741, organizations must upgrade Rsync to version 3.5.2 or later. Regularly review and apply security patches to maintain system integrity. Additionally, consider restricting access to public daemon modules to minimize exposure to potential attacks.