rsync through 3.5.1 contains a denial of service vulnerability
in the delta-transfer sender's hash_search() in match.c that
allows malicious receivers to trigger unbounded strong-checksum
work at consecutive offsets. Unauthenticated attackers pulling
from a public daemon module can supply weak checksums colliding
with consecutive rolling windows plus non-matching strong
checksums, exhausting sender CPU across concurrent
connections.