# Rsync 3.5.2 patches CVE-2026-119741 checksum DoS, fixes interrupted transfer corruption

> **Key takeaway:** Rsync 3.5.2 fixes a denial-of-service vulnerability where malicious receivers could force excessive checksum computation, plus resolves data corruption in resumed --append/--inplace transfers.

**Published:** 2026-11-04T07:18:13+00:00 
**Source:** Linuxiac 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/rsync-352-patches-cve-2026-119741-checksum-dos-fixes-interru.html 

## Summary
Rsync 3.5.2, a maintenance release of the ubiquitous file synchronization tool, patches CVE-2026-119741 and corrects long-standing data integrity issues in interrupted transfers. The CVE involves a malicious receiver supplying weak checksums that repeatedly collide with rolling windows, forcing the sender into computationally expensive strong-checksum calculations. Separately, transfers using --append and --inplace could previously write the final 256 KiB buffer twice upon interruption, leaving destination files with corrupted prefixes that broke subsequent resume attempts.

The release also introduces --nice for process priority control and --delay-symlinks for deferred symlink creation, alongside performance improvements for sparse files and files with repeated data patterns. Additional fixes cover daemon stack overflows, hard-link failure recovery, restricted-environment uploads, and various portability issues across Cygwin, MSYS2, and Solaris 10.

## Security and reliability fixes in Rsync 3.5.2
- **CVE-2026-119741 (checksum DoS):** A malicious receiver can exploit weak checksum collisions to force the sender into excessive strong-checksum computation, creating a denial-of-service condition through computational exhaustion.
- **Interrupted transfer corruption:** Transfers using --append and --inplace previously risked writing the final 256 KiB buffer twice upon interruption; the fix ensures clean destination file prefixes for correct subsequent resume or repair.
- **Sparse and repetitive file matching:** The checksum-matching algorithm now handles cases where duplicate checksum chains previously exhausted the search limit, improving synchronization of large sparse files or files with repeated data blocks.
- **Daemon stability:** A stack overflow in the daemon receiver is fixed, which occurred when queued deletion output hit the --max-alloc limit; quiet daemon transfers now skip deletion message queuing unless explicitly requested.
- **Hard-link resilience:** Failed hard-link creation no longer aborts or hangs the generator; Rsync recovers by forming new hard-link groups when destination inodes cannot accept additional links.

## Why it matters
Rsync underpins nightly backups, deployment pipelines, and distribution mirroring across Linux infrastructure, making the checksum DoS and transfer corruption fixes critical for system administrators and DevOps workflows. The --nice and --delay-symlinks options provide finer operational control for large-scale transfers, while the daemon and hard-link fixes reduce failure modes in automated synchronization services that depend on Rsync's long-running process stability.