Description

rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference that terminates the client connection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-13T15:19:59.813Z",
  "pubdate": "2026-08-13T15:19:59.813Z",
  "executiveSummary": "A null pointer dereference vulnerability exists in the rsync daemon child process affecting rsync versions 3.0.0 through 3.5.0.\nThe vulnerability allows remote attackers to cause a denial of service by crashing the daemon process.\nExploitation requires sending a maliciously crafted file list to the exposed rsync service where the first entry is a dot entry not explicitly typed as a directory.\nThe core risk involves operational disruption through service termination, affecting availability for systems running vulnerable rsync daemon configurations.\nNo authentication or elevated privileges are strictly required to trigger the crash if the attacker can establish a network connection to the rsync daemon.",
  "technicalDetails": "The vulnerability resides within the daemon child process of the rsync software, specifically in how the application parses and processes incoming file lists from remote clients.\nThe root cause is an insufficient input validation check prior to memory structure dereferencing. When processing the received file list, the rsync daemon expects the first entry to conform to specific structural expectations if it is a dot entry representing a directory.\nIf a remote attacker transmits a file list whose initial entry is a dot entry that lacks the proper directory type designation, the daemon fails to verify the entry type before processing.\nConsequently, the daemon attempts to dereference this unvalidated entry as a directory structure pointer.\nBecause the pointer is invalid, uninitialized, or points to an unexpected memory layout, the operation results in a null pointer dereference.\nThis memory access violation immediately triggers a fatal error condition that terminates the client connection and crashes the daemon child process, leading to a denial of service condition.\nThe affected component is the file list parsing logic within the rsync daemon process.\nImpacted versions include rsync 3.0.0 up to, but not including, version 3.5.0.\nThe attack vector is network-based, exploiting the daemon protocol exposure without requiring prior authentication or administrative privileges."
}