CVE-2026-53794
Received Received - Intake

rsync Memory Allocation Bypass Leading to DoS

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory allocations for file list and data structures, potentially exhausting available memory and causing a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-53794
EUVD
EUVD-2026-58033

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rsync rsync to 3.5.0 (exc)
rsync rsync to 3.4.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1284 The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a logic error in rsync versions before 3.5.0 related to the --max-alloc parameter. When set to 0, it disables memory allocation sanity checks instead of enforcing a zero-byte cap. Attackers can exploit this to cause unbounded memory allocations, leading to memory exhaustion and denial of service.

Detection Guidance

Check rsync version with 'rsync --version' to see if it is 3.4.3 or earlier. Monitor for unusual memory usage spikes during rsync operations. Inspect logs for '--max-alloc=0' usage in rsync commands or configurations.

Impact Analysis

If you use rsync versions 3.4.3 or earlier, an attacker could exploit this flaw to exhaust system memory by sending specially crafted requests with --max-alloc=0. This could crash your rsync daemon or server, disrupting file transfer services and causing downtime.

Mitigation Strategies

Upgrade rsync to version 3.5.0 or later immediately. Disable or restrict '--max-alloc=0' in rsync configurations. Ensure rsync daemon configurations reject zero values for '--max-alloc'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53794. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart