Open-source file sync tool rsync 3.5.2 fixes a CPU exhaustion flaw
The rsync project released version 3.5.2, and it closes a flaw that let a connecting client tie up a server’s CPU with checksum math that leads nowhere. The new version also lets you push a transfer to the back of the queue for CPU and disk, so a big sync stops elbowing everything else on the machine.
rsync is an open-source utility that copies files locally and across a network, and it is widely used for mirroring software archives and for backups. It keeps transfers small by sending only the parts of a file that changed, which is what makes it bearable over a slow link. The receiving side cuts its copy into blocks and sends the sender a cheap rolling checksum and a stronger checksum for each one. The sender slides a window across its copy, matches the cheap checksum first, then computes the strong one to confirm the block is identical.
That loop is where CVE-2026-119741 lives, in hash_search() in match.c. A malicious receiver sends weak checksums that collide with one rolling window after another, paired with strong checksums that do not match, and the sender keeps grinding out strong checksums that fail. A few connections at once and the CPU is gone. Every version through 3.5.1 is affected. VulnCheck, which assigned the ID, calls it inefficient algorithmic complexity and scores it 8.7 on CVSS 4.0, 7.5 on CVSS 3.1, all of it availability and nothing on your data.
If you run a public daemon module, anyone can do this without an account. Pulling files is what the module is for.
Version 3.5.2 also adds process-priority controls. The new --nice and --no-nice options set CPU and I/O scheduling priority for the local process, the remote one, or both, and the two values compose independently. A daemon client may request only CPU nice 19, idle I/O priority, or both, and rrsync, the restricted SSH wrapper, accepts local reductions alone. When a local change is unsupported or denied, rsync warns and the transfer continues. Remote settings need a peer that supports them, while local-only settings work against older peers.
