rsync Denial of Service via --zt Option Exhaustion

Executive Summary

This is a denial-of-service vulnerability in rsync versions 3.4.2 through 3.4.4. A remote attacker can exploit the --zt short alias for --compress-threads to spawn an excessive number of Zstandard worker threads on the receiver by specifying a large value like --zt=N. This bypasses refuse options directives that block long option names, exhausting system resources such as threads and memory.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows attackers to crash or severely degrade the performance of rsync servers by consuming all available threads and memory. This can disrupt legitimate services running on the affected machine, leading to downtime or degraded functionality for other processes.

Useful 0 Not Useful 0