CVE-2026-53794

Name
CVE-2026-53794
Description
rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory allocations for file list and data structures, potentially exhausting available memory and causing a denial of service.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
disclosure@vulncheck.com https://github.com/RsyncProject/rsync/releases/tag/v3.5.0
disclosure@vulncheck.com https://github.com/RsyncProject/rsync/security/advisories/GHSA-p827-vwcp-m964
disclosure@vulncheck.com https://www.vulncheck.com/advisories/rsync-denial-of-service-via-max-alloc-0-logic-error

Match rules

CPE URI Source package Min version Max version

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
rsync edge-main 3.5.0-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
rsync 3.24-main 3.5.0-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
rsync 3.23-main 3.5.0-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
rsync 3.22-main 3.5.0-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
rsync 3.21-main 3.5.0-r0 Natanael Copa <ncopa@alpinelinux.org> fixed