Description

rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory allocations for file list and data structures, potentially exhausting available memory and causing a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-13T15:19:43.853Z",
  "pubdate": "2026-08-13T15:19:43.853Z",
  "executiveSummary": "A logic error vulnerability exists in rsync before 3.5.0 specifically within the handling of the --max-alloc command-line option and configuration settings.\nThe flaw allows a malicious sender or a configuration setting of --max-alloc=0 to entirely disable memory allocation sanity checks, rather than enforcing a strict zero-byte cap as intended.\nAn unauthenticated remote attacker can exploit this vulnerability to induce unbounded memory allocations on the receiving end for critical structures such as file lists and internal data buffers.\nSuccessful exploitation leads directly to resource exhaustion, resulting in a denial of service (DoS) via an out-of-memory condition on the host running the rsync receiver.\nThe risk implications are high for environments that publicly expose rsync services or ingest data from untrusted senders, as the attack requires minimal attacker capabilities beyond initiating a synchronization session with malformed parameters or control data.",
  "technicalDetails": "The vulnerability resides within the memory allocation validation logic of rsync before 3.5.0, specifically in how the application processes the --max-alloc parameter.\nThe root cause is a conditional logic error where setting --max-alloc=0—or receiving corresponding configuration instructions from a remote sender—bypasses allocation sanity checks entirely instead of restricting memory consumption to zero bytes.\nThe vulnerable component is the memory management and allocation enforcement routine responsible for bounding data structures such as file lists and transfer metadata.\nAffected versions comprise all rsync releases prior to 3.5.0.\nExploitation does not require authentication or privileged access; an attacker interacting with a vulnerable rsync receiver can trigger the flaw.\nThe attack flow proceeds as follows: First, the attacker establishes a connection to the vulnerable rsync receiver either as a malicious sender or by supplying a configuration input specifying --max-alloc=0. Second, during the initialization or synchronization phase, the receiver evaluates the max-alloc threshold. Due to the logic error, the zero value disables the sanity checks instead of enforcing a zero-byte limit. Third, the attacker transmits a crafted payload or file list requiring massive memory allocation. Fourth, the rsync receiver attempts an unbounded memory allocation to accommodate the incoming data structures. Finally, the unbounded allocation exhausts available system memory, leading to an immediate denial of service through application crash or system-wide resource starvation."
}