Is CVE-2026-119741 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-119741?

CVE-2026-119741 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-119741

Description

rsync through 3.5.1 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.