The vulnerability lies in rsync’s delta‑transfer sender hash_search() function, which can be forced to perform unbounded strong‑checksum calculations through crafted checksum collisions. An attacker can cause the sender to churn through many verification rounds, exhausting CPU resources and naming this as a denial‑of‑service flaw. The weakness is a poor handling of hash collisions (CWE‑407).

This weakness affects Rsync by RsyncProject versions 3.5.1 and earlier. In practice, any system running a public rsync daemon that accepts unauthenticated pulls is susceptible.

The CVSS score of 8.7 marks the vulnerability as high severity. Because the EPSS score is not available, the exact likelihood of exploitation is unclear, but the flaw can be triggered by any remote client that can initiate a pull request to a public rsync server. The vulnerability is not listed in the CISA KEV catalog, though it could be exploited from anywhere on the Internet against exposed, unauthenticated rsync daemons.