rsync versions before 3.5.0 contain an algorithmic complexity flaw in the hash_search() routine that allows a remote sender to craft a file list causing quadratic‑time hash lookups. The resulting CPU exhaustion can sustain a denial of service against the receiving daemon. The weakness is a classic example of CWE-407, where worst‑case complexity leads to resource depletion.

The affected product is rsync from the RsyncProject. All releases older than 3.5.0 are vulnerable, as the problem was fixed in the 3.5.0 release.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is not available, so current exploitation probability is unknown, but the absence from the CISA KEV catalog suggests no widely known live exploits yet. Based on the description, a remote attacker must be able to send a specially crafted file list to the rsync daemon; as the attack relies on CPU exhaustion, it is most likely carried out from a sender with network access to the receiver. The impact scope is limited to the performance and availability of the rsync service and any dependent services that rely on data transfer via rsync.