rsync versions before 3.5.0 contain an algorithmic complexity flaw in the hash_search() routine that allows a remote sender to craft a file list causing quadratic‑time hash lookups. The resulting CPU exhaustion can sustain a denial of service against the receiving daemon. The weakness is a classic example of CWE-407, where worst‑case complexity leads to resource depletion; it also exemplifies CWE-770, for uncontrolled resource consumption.

The affected product is rsync from the RsyncProject. All releases older than 3.5.0 are vulnerable, as the problem was fixed in the3.5.0 release.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is < 1%, indicating a very low but non-zero probability of exploitation, but the absence from the CISA KEV catalog suggests no widely known live exploits yet. Based on the description, a remote attacker must be able to send a specially crafted file list to the rsync daemon; as the attack relies on CPU exhaustion, it is most likely carried out from a sender with network access to the receiver. The impact scope is limited to the performance and availability of the rsync service and any dependent services that rely on data transfer via rsync.