Threat video1:00
CVE-2026-119741 rsync hash_search DoS: Detection & IOCs
A malicious receiver can exhaust rsync sender CPU with colliding checksums. Includes 9 detection rules, 12 IOCs and a free Splunk SPL rule.
Read the full threat intel for CVE-2026-119741 rsync hash_search DoS: Detection & IOCs →
Chapters
- 0:00The hookRsync through 3.5.1 vulnerable to CPU exhaustion.
- 0:05The storyReceiver sends colliding weak checksums.
- 0:12Attack pathReceiver connects and sends colliding checksums.
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromise9 indicators to hunt: 4 URLs, 1 hash and 3 file names, and more.
- 0:39MITRE ATT&CK techniques4 ATT&CK techniques, from reconnaissance to impact.
- 0:43Remediation11 remediation steps are listed, 3 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Rsync through 3.5.1 vulnerable to CPU exhaustion.
0:06Receiver sends colliding weak checksums.
0:08Sender CPU exhausted; service degraded.
0:12Receiver connects and sends colliding checksums.
0:15Sender repeats expensive strong-checksum verification.
0:19CPU exhausted; service availability degraded.
0:22Upgrade to rsync 3.5.2 immediately.
0:28No threat actor is attributed. Confidence: low.
0:339 indicators to hunt: 4 URLs, 1 hash and 3 file names, and more.
0:394 ATT&CK techniques, from reconnaissance to impact.
0:4411 remediation steps are listed, 3 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.