{"id":"CVE-2026-119741","summary":"rsync \u003c 3.5.2 Denial of Service via hash_search() Checksum Collisions","details":"rsync before 3.5.2 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.","modified":"2026-11-06T17:27:28.196991729Z","published":"2026-11-03T15:26:27.533Z","related":["openSUSE-SU-2026:12443-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119741.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-407"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119741.json"},{"type":"ADVISORY","url":"https://github.com/RsyncProject/rsync/releases/tag/v3.5.2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119741"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/rsync-through-3.5.1-denial-of-service-via-hash-search-checksum-collisions"},{"type":"FIX","url":"https://github.com/RsyncProject/rsync/commit/a7404a9a633cff28ee1602f328b9c3fa69cdbd04"},{"type":"FIX","url":"https://github.com/RsyncProject/rsync/pull/1132"},{"type":"PACKAGE","url":"https://github.com/RsyncProject/rsync"},{"type":"ARTICLE","url":"https://github.com/RsyncProject/rsync/blob/a7404a9a633cff28ee1602f328b9c3fa69cdbd04/testsuite/hashsearch-collision-skip_test.py"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.samba.org/rsync.git/","events":[{"introduced":"0"},{"last_affected":"04355d27b7386d7de0e6bd5e79c556223210f700"}],"database_specific":{"extracted_events":[{"source":"CPE_RANGE","cpe":"cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*","range":[{"introduced":"0"},{"last_affected":"3.5.1"}]}]}},{"type":"GIT","repo":"https://github.com/rsyncproject/rsync","events":[{"introduced":"0"},{"fixed":"a7404a9a633cff28ee1602f328b9c3fa69cdbd04"},{"fixed":"41bbd895668767e155b2eb6da64f37afa9cb8724"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*","range":[{"introduced":"0"},{"last_affected":"3.5.1"}],"source":"CPE_RANGE"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"a7404a9a633cff28ee1602f328b9c3fa69cdbd04"}]},{"source":"REFERENCES_TAG","original_tag":"v3.5.2","range":[{"fixed":"41bbd895668767e155b2eb6da64f37afa9cb8724"}]}]}}],"versions":["v3.5.1","v3.5.0","v3.4.3","v3.4","v3.2.7","v3.4.1","v3.4.2","v3.4.0","v3.3.0","v3.3.0pre1","v3.2.7pre1","v3.2.6","v3.2.5","v3.2.5pre2","v3.2.5pre1","v3.2.4","v3.2.4pre4","v3.2.4pre3","v3.2.4pre2","v3.2.4pre1","v3.2.3","v3.2.3pre1","v3.2.2","v3.2.2pre3","v3.2.2pre2","v3.2.2pre1","v3.2.1","v3.2.1pre1","v3.2.0","v3.2.0pre3","v3.2.0pre2","v3.2.0pre1","v3.1.3","v3.1.3pre1","v3.1.2","v3.1.2pre1","v3.1.1","v3.1.1pre2","v3.1.1pre1","v3.1.0","v3.1.0pre1","v3.0.3","v3.0.3pre3","v3.0.3pre2","v3.0.3pre1","v3.0.2","v3.0.1","v3.0.1pre3","v3.0.1pre2","v3.0.1pre1","v3.0.0","v3.0.0pre10","v3.0.0pre9","v3.0.0pre8","v3.0.0pre7","v3.0.0pre6","v3.0.0pre5","v3.0.0pre4","v3.0.0pre3","v3.0.0pre2","v3.0.0pre1","v2.6.9","v2.6.9pre3","v2.6.9pre2","v2.6.9pre1","v2.6.8","v2.6.8pre1","v2.6.7","v2.6.7pre3","v2.6.7pre2","v2.6.7pre1","v2.6.6pre1","v2.6.5","v2.6.5pre2","v2.6.5pre1","v2.6.4","v2.6.4pre4","v2.6.4pre3","v2.6.4pre2","v2.6.4pre1","v2.6.3","v2.6.3pre2","v2.6.3pre1","v2.6.2","v2.6.2pre1","v2.6.1","v2.6.1pre2","v2.6.1pre1","v2.6.0","v2.6.0pre2","v2.6.0pre1","v2.5.6","v2.5.5","v2.5.5.rc1","v2.5.4","v2.5.4pre1","v2.5.3","v2.5.3pre1","v2.5.2","v2.5.2pre3","v2.5.2pre2","v2.5.2pre1","v2.5.1","v2.5.1pre3","v2.5.1pre2","v2.5.1pre1","v2.5.0","v2.4.7pre4","v2.4.7pre2","mbp_bk_export0","v2.4.6","v2.4.5","v2.4.4","v2.4.3","v2.4.2","v2.4.1","v2.4.0","v2.3.2","v2.3.1","v2.3.0","v2.2.1","v2.2.0","v2.1.1","v2.1.0","v2.0.19","v2.0.18","v2.0.17","v2.0.16","v2.0.15","v2.0.14","v2.0.13","v2.0.12","v2.0.11","v2.0.10","v2.0.9","v2.0.8","v2.0.7","v2.0.6","v2.0.5","v2.0.4","v2.0.3","v2.0.2","v2.0.1","v2.0.0","v1.7.4","v1.7.3","v1.7.2","v1.7.1","v1.7.0","v1.6.9","v1.6.8","v1.6.7","v1.6.6","v1.6.5","v1.6.4"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-119741.json","vanir_signatures":[{"source":"https://github.com/rsyncproject/rsync/commit/a7404a9a633cff28ee1602f328b9c3fa69cdbd04","target":{"file":"match.c","function":"hash_search"},"deprecated":false,"digest":{"function_hash":"196272633595348515794487784010099173052","length":4595},"id":"CVE-2026-119741-86c6d619","signature_type":"Function","signature_version":"v1"},{"target":{"file":"match.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["222583652065927298891373781410352731032","46702643079240347345949666242665405763","196702461722665065118137742739233032736","168166512177199752738238920952990886263","59956254540731417766246849872843382679","156431106897721129071982559569779940676","197345932693450956427242206360439269031","258441830710785073569861531165866887098","52799493023395912835658781929972464544","32192690125148816750970784948242002331","331882305775114575639114041612321598518","307123975501110214530583557852311046230","154043316384918748998953343368913523958","232138583080440148344628885353460005893","312716698207645387561411998573215034395","290961002513699125171894433517786521908","54612615253193540731521671591694984643","231027398382047766719916737131607837305","118816967375522786998487355197986449849","16391638831376302438684999601885773592","164533731009480765044166729260337748813","86124054139273561111896960758364685440","136209984594447208659018310922553408797","27652305843320205074404335201494735587","339624632580098445135955230035074673520","72054908273417176094338709536378996027","269644873515906531649234462574395500613","69758893896735746464640631426441526325","98299292672126816673066796906183521358","261559492453927249561089408321252318921","257880823181121394093889959485638929190","298925858114546597040015969069657850432","7058458440310615320121141230501535915","105740417466844742193647222385890426274","117444980788111633934549786525662258869","190185365025331022047699730535318988466","316345792575055334296080494180206843582","289499885323401689237113464210930644368","108614416035228665255553068410792490778","145584678188291753601395169791826692640","7717553633356301250511779253140015542"]},"id":"CVE-2026-119741-fe81e0df","signature_type":"Line","signature_version":"v1","source":"https://github.com/rsyncproject/rsync/commit/a7404a9a633cff28ee1602f328b9c3fa69cdbd04"}],"vanir_signatures_modified":"2026-11-06T07:06:06Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}