rsync 3.5.2 fixes CPU exhaustion flaw, Help Net Security reports

What happened

According to Help Net Security, the rsync project released version 3.5.2. Help Net Security says this version fixes a flaw that lets a connecting client tie up a server’s CPU with checksum work that leads nowhere. The report says the flaw is tracked as CVE-2026-119741.

Help Net Security says the bug is in hash_search() in match.c. This is the loop where the sender matches a cheap rolling checksum and then computes a strong checksum to confirm a block. According to the report, a malicious receiver can send weak checksums that collide with one rolling window after another, paired with strong checksums that do not match. The sender then keeps computing strong checksums that fail. Help Net Security says a few simultaneous connections can exhaust the CPU.

The report says VulnCheck assigned the CVE ID and describes the flaw as inefficient algorithmic complexity. According to Help Net Security, VulnCheck scores it 8.7 on CVSS 4.0 and 7.5 on CVSS 3.1, with all of the impact on availability and none on data.

This advisory relies on a single outlet. No rsync project advisory, VulnCheck record or NVD record was among the provided sources. The severity shown on this page is a conservative editorial rating for that reason. It is not a vendor or CNA rating, and the CVSS scores VulnCheck reportedly assigned are higher. In-the-wild exploitation is not confirmed.

Am I affected?

• According to Help Net Security, every rsync version through 3.5.1 is affected.
• The report says anyone can trigger the flaw without an account if you run a public daemon module, because pulling files is what the module is for.
• The source does not detail exposure for other setups, such as SSH-only transfers. That exposure is not confirmed.

What to do now

1. Check which rsync version runs on your servers and mirrors. Versions through 3.5.1 are affected, per Help Net Security.
2. Upgrade to rsync 3.5.2, which the report says contains the fix.
3. Upgrade hosts that expose public rsync daemon modules first. The report says these can be targeted without an account.
4. Optionally, review the new --nice and --no-nice options in 3.5.2. Help Net Security says they set CPU and I/O scheduling priority for the local process, the remote process, or both. The report also says a daemon client may request only CPU nice 19, idle I/O priority, or both. The report presents this as a new feature, not as a mitigation for the CVE.

Sources

• Help Net Security: Open-source file sync tool rsync 3.5.2 fixes a CPU exhaustion flaw