Description

rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU resources with a modest number of crafted entries, causing a sustained denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T15:19:58.893Z",
  "pubdate": "2026-08-13T15:19:58.893Z",
  "executiveSummary": "An algorithmic complexity vulnerability exists within the hash_search() function of rsync before version 3.5.0, exposing systems to a targeted denial of service condition.\nThe flaw stems from quadratic-time worst-case behavior during hash lookups, allowing a remote attacker to manipulate hash table collision handling.\nBy delivering a carefully crafted file list containing malicious entries, a malicious sender can exhaust receiver CPU resources with minimal requests.\nThis sustained resource exhaustion degrades system performance or renders the affected rsync service entirely unavailable, impacting operational integrity.\nThe attack requires remote network interaction where an attacker acts as a sender supplying a malicious file list to a receiving rsync instance.\nNo authentication or elevated privileges are explicitly required to initiate the connection that delivers the crafted file list, broadening the risk profile for exposed services.",
  "technicalDetails": "The vulnerability resides in the hash_search() function implemented within the rsync codebase, specifically affecting versions prior to 3.5.0.\nThe root cause is an algorithmic complexity flaw manifesting as quadratic-time O(n^2) worst-case behavior during hash lookups.\nWhen processing file lists supplied by a remote sender, the hash_search() function performs lookups that become computationally expensive upon encountering maliciously crafted inputs designed to trigger excessive hash collisions.\nA remote attacker initiates the attack flow by establishing a standard rsync session and acting as the sender transmitting a meticulously engineered file list.\nThe payload consists of specially crafted entries constructed to exploit the deterministic weaknesses in the hashing mechanism utilized by the receiver.\nAs the receiver attempts to parse and resolve the incoming file list, the vulnerable hash_search() function falls into its worst-case computational path.\nThe resulting excessive CPU utilization rapidly exhausts available processing resources on the receiving host, even when utilizing only a modest number of crafted entries.\nThis sustained CPU starvation prevents the rsync daemon or process from servicing legitimate requests, culminating in a persistent denial of service condition.\nThe affected component is exposed over standard network protocols used by rsync, requiring no prior authentication or administrative privileges from the remote attacker to transmit the malicious payload."
}