rsync delta-transfer sender hash_search weak-checksum collision CPU exhaustion

During rsync delta transfer, the sender's hash_search() in match.c tries to match receiver-supplied rolling checksums. A malicious receiver can send weak checksums that collide with consecutive rolling windows but fail strong checksums, causing the sender to repeatedly recompute strong checksums at consecutive offsets. Affected versions are rsync through 3.5.1. Unauthenticated attackers pulling from a public daemon module can trigger this and exhaust sender CPU across concurrent connections.

The vendor HIGH 7.5 rating overstates real-world exposure. The flaw is availability-only—no code execution, no data exfiltration—and only bites rsync daemon modules that are reachable without authentication. Most enterprise rsync runs over SSH rather than rsyncd, and public daemon modules are typically mirrors with connection limits or network allowlists. For most defenders this is a MEDIUM, not a HIGH.

Sources.

1. VulDB — CVE-2026-119741
2. VulDB — RsyncProject rsync denial of service
3. Rapid7 — CVE-2026-119741
4. DevGuard Vulnerability Database — CVE-2026-119741
5. VulnCheck Advisory — rsync through 3.5.1 DoS via hash_search()
6. NVD — CVE-2026-119741

Run on each rsync server (Linux/macOS) as root or a user with read access to process list and config. Invocation: bash check_rsync_cve_2026_119741.sh. Outputs VULNERABLE, PATCHED, or UNKNOWN with exit codes 0/1/2.

#!/usr/bin/env bash
# CVE-2026-119741 checker for rsync daemon hosts
set -u

VULN_VER="3.5.1"

if ! command -v rsync >/dev/null 2>&1; then
  echo "UNKNOWN: rsync not installed"
  exit 2
fi

ver=$(rsync --version | awk 'NR==1{print $3}')
if [ -z "$ver" ]; then
  echo "UNKNOWN: cannot parse rsync version"
  exit 2
fi

# Determine if daemon mode is configured/running
daemon=0
if [ -f /etc/rsyncd.conf ]; then daemon=1; fi
if pgrep -x rsync >/dev/null 2>&1; then daemon=1; fi
if command -v ss >/dev/null 2>&1 && ss -ltn 2>/dev/null | grep -q ':873 '; then daemon=1; fi

# Version comparison: if max of (VULN_VER, ver) is VULN_VER, then ver <= VULN_VER
max=$(printf '%s\n' "$VULN_VER" "$ver" | sort -V | tail -1)
if [ "$max" = "$VULN_VER" ]; then
  vuln_ver=1
else
  vuln_ver=0
fi

if [ "$vuln_ver" -eq 0 ]; then
  echo "PATCHED: rsync version $ver is newer than $VULN_VER"
  exit 1
fi

if [ "$daemon" -eq 1 ]; then
  echo "VULNERABLE: rsync version $ver <= $VULN_VER and daemon/config/port 873 found"
  exit 0
else
  echo "UNKNOWN: rsync version $ver <= $VULN_VER but no daemon mode detected on this host"
  exit 2
fi