rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU resources with a modest number of crafted entries, causing a sustained denial of service.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rsync-rrsyncUpgrade rsync-daemonUpgrade rsync | Oct 11, 2026 | Sep 14, 2026 |
| Alpine Linux | — | Upgrade rsync | Sep 1, 2026 | Aug 13, 2026 |
| Amazon Linux Ami 2 | — | Upgrade rsyncUpgrade rsync-debuginfo | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade rsyncUpgrade rsync-debuginfoUpgrade rsync-debugsourceUpgrade rsync-daemon | Sep 30, 2026 | Aug 13, 2026 |
| Debian | — | Upgrade rsync | Sep 30, 2026 | Aug 13, 2026 |
| Freebsd | — | Upgrade rsync | Aug 27, 2026 | Aug 25, 2026 |
| Oracle_linux | — | Upgrade rsync-daemonUpgrade rsync-rrsyncUpgrade rsync | Oct 22, 2026 | Aug 13, 2026 |
| Redhat Openshift | — | Upgrade ose-rhel-coreos | Oct 1, 2026 | Aug 13, 2026 |
| Redhat_linux | — | No solution existsUpgrade rsync-daemonUpgrade rsync-rrsyncUpgrade rsyncUpgrade rsync-debuginfoUpgrade rsync-debugsource | Aug 21, 2026 | Aug 13, 2026 |
| Rocky_linux | — | Upgrade rsyncUpgrade rsync-debuginfoUpgrade rsync-debugsource | Sep 17, 2026 | Sep 15, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 15, 2026 | Aug 13, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub