rsync EUVD-2026-115914

Exploitation requires the target to run rsync in daemon mode (rsyncd) exposing a public or anonymous module that permits pull/download transfers, with the attacker acting as the receiving peer in the delta-transfer protocol; the attacker then crafts weak-checksum collisions at consecutive rolling-window offsets paired with non-matching strong checksums to trigger the O(N) strong-checksum walk in hash_search(). Limiting factors: default rsync usage as an SSH-invoked client or one-off command does not expose this vector - only a configured, reachable public daemon module does - and impact is confined to CPU/availability exhaustion (no confidentiality or integrity loss). Authentication is not required per the CVSS vector (PR:N), but a non-default public-daemon deployment is a hard prerequisite.

This is a genuine but bounded operational risk rather than a top-tier emergency. The CVSS 4.0 signals (AV:N/AC:L/AT:N/PR:N/UI:N, score 8.7) describe a remote, low-complexity, unauthenticated path with high availability impact and zero confidentiality or integrity impact (VC:N/VI:N/VA:H) - consistent with CWE-407 (inefficient algorithmic complexity / algorithmic-complexity DoS). The vuln.today decision label is 'this_week', not act_now or emergency, which aligns with a resource-exhaustion DoS that is serious for exposed daemons but not a code-execution or data-exposure flaw. No EPSS score is provided and the vulnerability is NOT in CISA KEV, so there is no evidence of active or widespread exploitation; it was reported by VulnCheck with a vendor patch already available. The input marks no confirmed public exploit, though the upstream fix (PR #1132) ships a regression test (hashsearch-collision-skip_test.py) that concretely demonstrates the collision-flood technique, lowering the bar for weaponization. The key real-world qualifier not captured by the network CVSS vector: exploitation requires the target to run rsync as a daemon exposing a public/anonymous module that permits pulls - a non-default deployment. So while the raw score is high, actual exposure is limited to internet-facing or shared rsync daemon servers; hosts using rsync only as an ad-hoc SSH client are not reachable via this vector.

An attacker connects to an internet-facing rsync daemon offering a public, anonymous, pullable module and initiates a file transfer as the receiver. During delta transfer the attacker supplies weak (rolling) checksums that collide at consecutive offsets together with non-matching strong checksums, forcing the sender's hash_search() in match.c into unbounded per-byte strong-checksum computation and exhausting server CPU across concurrent connections. No authentication or user interaction is required (PR:N/UI:N), though no confirmed working exploit is published - only an upstream regression test that demonstrates the collision pattern.