Rsync 3.5.2 Patches CPU Exhaustion Vulnerability, Adds Resource Controls
Rsync version 3.5.2 addresses CVE-2026-119741, a critical CPU exhaustion flaw, and introduces new process priority controls for better resource management.
The rsync project has released version 3.5.2, patching a significant CPU exhaustion vulnerability, CVE-2026-119741, that could allow a malicious client to cripple a server's processing power. This flaw, present in all versions prior to 3.5.2, enables denial-of-service conditions, particularly impacting publicly accessible rsync daemon modules.
Rsync, a ubiquitous open-source utility for efficient file copying locally and across networks, relies on a clever mechanism to minimize data transfer. It achieves this by calculating checksums of file blocks on the receiving end and comparing them against checksums generated by the sender. The sender then uses a sliding window to match these checksums, sending only the changed portions of files.
The vulnerability, identified within the hash_search() function in match.c, arises from a specific interaction during this checksum process. A malicious receiver can exploit this by sending a series of weak checksums that intentionally collide with the sender's rolling window, paired with strong checksums that do not match. This forces the rsync server to continuously compute and verify strong checksums that ultimately fail, consuming excessive CPU resources.
VulnCheck, which assigned the CVE ID, categorizes this as an "inefficient algorithmic complexity" issue. It has been assigned a CVSS 4.0 score of 8.7 and a CVSS 3.1 score of 7.5, with the primary impact being on availability rather than data integrity or confidentiality.
For users running public rsync daemon modules, the risk is amplified as any unauthenticated user can potentially trigger this vulnerability. This makes servers exposed to the internet particularly susceptible to such denial-of-service attacks, especially when serving files to the public.
In addition to patching CVE-2026-119741, version 3.5.2 introduces new process priority controls. The --nice and --no-nice options allow users to manage the CPU and I/O scheduling priority for both local and remote processes involved in a transfer. This feature aims to prevent large synchronization tasks from monopolizing system resources and impacting other operations.
These new priority controls can be applied independently to CPU and I/O, offering granular control over resource allocation. While remote settings require a compatible peer, local-only settings can be used with older rsync versions. The project notes that unsupported or denied remote settings will result in a warning, but the transfer will continue.
The release of rsync 3.5.2 is a critical update for all users, especially those operating public rsync servers. The fix for CVE-2026-119741 mitigates a significant denial-of-service risk, while the new resource management features enhance the stability and performance of rsync operations in busy environments.