Open-source file sync tool rsync 3.5.2 fixes a CPU exhaustion flaw
ID: f3e0e968-910c-59c7-8f5c-d4347e8f40dd
STIX ID: report--f3e0e968-910c-59c7-8f5c-d4347e8f40dd
Feed Name: Help Net Security
Threat Score
Rsync 3.5.2 patches CVE-2026-119741, an algorithmic-complexity denial-of-service in hash_search() that allows a malicious receiver (including unauthenticated pulls from a public daemon) to tie up sender CPU by provoking repeated strong-checksum computations; users should update from affected versions (through 3.5.1). The release also introduces --nice and --no-nice options to control CPU and I/O scheduling for local and remote processes as an operational mitigation.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.