Is CVE-2026-119741 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119741 being exploited in the wild.

How severe is CVE-2026-119741?

High severity, with a CVSS score of 7.5, published 3 November 2026.

Which products and versions are affected?

RsyncProject Rsync through 3.5.1.

Is there a fix for CVE-2026-119741?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-119741 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-119741?

Check whether you run RsyncProject Rsync at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119741: rsync denial of service in hash_search()

CVE-2026-119741 · Severity: high · CVSS 7.5 · Published 2026-11-03

rsync is a file synchronization utility used for backups and incremental transfers. An attacker pulling files from a public rsync server can craft malicious checksums that force the sender to perform excessive CPU-intensive hash computations, causing a denial of service that could make the server unresponsive to legitimate users.

Technologies: RsyncProject Rsync. Vendors: RsyncProject.

Quick answers

Is CVE-2026-119741 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119741 being exploited in the wild.
How severe is CVE-2026-119741?: High severity, with a CVSS score of 7.5, published 3 November 2026.
Which products and versions are affected?: RsyncProject Rsync through 3.5.1.
Is there a fix for CVE-2026-119741?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-119741 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-119741?: Check whether you run RsyncProject Rsync at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the delta-transfer sender's hash_search() function in match.c. An unauthenticated attacker can supply weak checksums that collide with consecutive rolling windows combined with non-matching strong checksums, triggering unbounded strong-checksum computation work. This can be exploited across multiple concurrent connections to exhaust sender CPU resources.

Affected products

RsyncProject rsync through 3.5.1

Timeline

2026-11-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.