Description

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T15:19:59.197Z",
  "pubdate": "2026-08-13T15:19:59.197Z",
  "executiveSummary": "A denial of service vulnerability exists in rsync versions 3.4.2 before 3.5.0, allowing a remote sender to exhaust system resources.\nThe vulnerability arises due to improper handling of the --zt short alias for the --compress-threads option during option parsing and validation.\nBy specifying the short alias --zt=N with a large numeric value, an attacker can bypass the refuse options directive's string matching mechanism, which is typically configured to restrict long option names.\nThis circumvention enables unauthorized control over thread creation parameters on the receiving system.\nThe impact includes the unbounded spawning of Zstandard worker threads on the receiver, leading to severe resource exhaustion of system threads and memory.\nAffected systems comprise deployments running vulnerable rsync server or daemon configurations where remote senders can initiate synchronization tasks.\nRisk implications include operational disruption, application crashes, and potential host instability due to resource starvation.\nAttacker capabilities require the ability to act as a remote sender interacting with a vulnerable rsync receiver, exploiting the lack of robust input validation and option normalization prior to restriction enforcement.",
  "technicalDetails": "The root cause of the vulnerability lies in a flaw within the option parsing and security filtering logic of rsync, specifically concerning how short option aliases are evaluated against the refuse options directive.\nThe vulnerable component is the option processing subsystem responsible for handling Zstandard compression configurations and enforcing administrative access controls.\nAffected versions are rsync 3.4.2 prior to version 3.5.0.\nThe attack vector is network-exposed, requiring the attacker to act as a remote sender interacting with the vulnerable rsync receiver over supported network protocols.\nAuthentication and privilege requirements depend on the rsync daemon configuration; however, unauthenticated or low-privileged remote senders interacting with exposed rsync services can typically trigger the parsing logic.\nStep-by-step exploitation occurs as follows: first, the remote sender initiates a connection and data transfer sequence with the rsync receiver. During the command-line argument negotiation phase, the sender provides the short alias argument --zt=N instead of the canonical long option --compress-threads=N.\nSecond, the rsync receiver processes the incoming arguments. The security restriction mechanism, specifically the refuse options directive, relies on string matching targeted primarily against long option names.\nBecause the input utilizes the short alias --zt, the string matching fails to recognize the restricted parameter, thereby bypassing the administrative prohibition.\nThird, the argument parser accepts the supplied value N without enforcing safe upper bounds on thread allocation.\nFourth, upon initiating the Zstandard decompression routines, the receiver spawns an unbounded number of worker threads corresponding to the attacker-supplied value of N.\nThe payload behavior involves the excessive instantiation of threads and associated memory allocations.\nThe post-exploitation impact is characterized by resource exhaustion, leading to thread table depletion, memory exhaustion, and subsequent denial of service affecting the host operating system or the rsync service."
}