Red Hat Security Advisory: rsync security update
🔗 CVE IDs covered (1)
📋 Description
CVE-2026-119741 — rsync: rsync: Denial of Service via crafted checksums during delta transfer
🎯 Affected products17
- Red Hat Enterprise Linux AppStream EUS (v.10.2)
- Red Hat Enterprise Linux BaseOS EUS (v.10.2)
- rsync-0:3.5.0-3.el10_2.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.10.2)
- rsync-0:3.5.0-3.el10_2.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.10.2)
- rsync-0:3.5.0-3.el10_2.1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.10.2)
- rsync-0:3.5.0-3.el10_2.1.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.10.2)
- rsync-0:3.5.0-3.el10_2.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.10.2)
- rsync-daemon-0:3.5.0-3.el10_2.1.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.10.2)
- rsync-debuginfo-0:3.5.0-3.el10_2.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.10.2)
- rsync-debuginfo-0:3.5.0-3.el10_2.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.10.2)
- rsync-debuginfo-0:3.5.0-3.el10_2.1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.10.2)
- rsync-debuginfo-0:3.5.0-3.el10_2.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.10.2)
- rsync-debugsource-0:3.5.0-3.el10_2.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.10.2)
- rsync-debugsource-0:3.5.0-3.el10_2.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.10.2)
- rsync-debugsource-0:3.5.0-3.el10_2.1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.10.2)
- rsync-debugsource-0:3.5.0-3.el10_2.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.10.2)
- rsync-rrsync-0:3.5.0-3.el10_2.1.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.10.2)
✅ Remediation
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. --- CME Mitigation Guidance (2026-11-06) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to bound delta-transfer strong-checksum calculations and eliminate redundant collision lookups in rsync hash_search(): upgrade to the corresponding fixed Red Hat builds, which unlink duplicate false-alarm hash chain entries sharing identical strong checksums and advance offset by a full block after four consecutive unmatched weak checksum collisions, closing all 2 injection vectors (crafted weak-checksum collision sequences with mismatched strong checksums, duplicate colliding block hash chains). Until patched, this is a concern on rsync daemon deployments serving delta transfers to unauthenticated or untrusted receivers, so restrict network access to rsync daemon modules or disable unauthenticated delta file transfers from untrusted receivers. As a compensating measure, Apply RLIMIT_CPU limits to rsync worker processes using ulimit or prlimit to contain excessive CPU consumption during delta checksum searches and Throttle incoming connection rates and concurrent sessions per IP to mitigate repeated unauthenticated delta transfer DoS attempts. These controls limit blast radius and contain exploitation, but they do not fix the underlying algorithmic complexity defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)