Logic Error in rsync Disabling Allocation Sanity Checks

CVE-2026-53794

What is CVE-2026-53794?

The rsync application, prior to version 3.5.0, contains a flaw in the handling of the --max-alloc option that can lead to significant vulnerabilities in memory allocation checks. When used with --max-alloc=0, this logic error may allow an attacker to bypass the allocation sanity checks entirely. Consequently, this can result in unbounded memory allocation attempts during the processing of file lists and relevant data structures. If exploited, this vulnerability could exhaust the available memory resources of the receiving system, ultimately leading to a denial of service. Users of rsync are advised to upgrade to version 3.5.0 or later to mitigate this risk.

References