Skip to content

GHSA-8x5r-mjx8-83hv on CTRL-OS 26.05

Aliases: GHSA-8x5r-mjx8-83hv, CVE-2026-70453

Packages: rsync

Status: Plausible

Advisory Information

The receiver controls the checksum set the sender searches. A crafted or degenerate set with a very long chain of EQUAL weak checksums drove the sender's per-offset match-verify into a quadratic blow-up.

Sustained quadratic CPU consumption is a shared host resource and persists rather than terminating the connection, so it is not scoped to the attacker's own transfer. Note this one is already public (rsync issue #217), so it is not embargoed with the rest.

Affected: through 3.4.4

Fixed in: 3.5.0 (MAX_CHAIN_LEN work bound in match.c; fix by Stuart Inglis)

Reporter: originally reported as a performance problem in public rsync issue #217 by heyciao (2021-09-01); recognised as a security issue, bounded and regression-tested by Stuart Inglis. Already public, not embargoed

Test: hashsearch-chain

Updates

2026-08-14 16:57 CEST

Metadata changes:

  • Status for package rsync: “Plausible”

2026-08-14 16:55 CEST

Metadata changes:

  • Status for package rsync: “New”