CVE-2026-53794: rsync < 3.5.0 Denial of Service via --max-alloc=0 Logic Error
rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory allocations for file list and data structures, potentially exhausting available memory and causing a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rsyncto a version that resolves this vulnerability.Fixed in 3.5.0 - Configuration
Ensure rsync is not configured/started with --max-alloc=0, since in rsync versions before 3.5.0 this logic error disables allocation sanity checks.
rsync --max-alloc = not 0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53794?
CVE-2026-53794 has a medium severity rating of 5.3.
What is the risk associated with CVE-2026-53794?
The risk associated with CVE-2026-53794 is rated at 27.
How do I fix CVE-2026-53794?
To fix CVE-2026-53794, upgrade rsync to version 3.5.0 or later.
What kind of attack can exploit CVE-2026-53794?
CVE-2026-53794 can be exploited to cause a Denial of Service by triggering unbounded memory allocation.
Which software is affected by CVE-2026-53794?
CVE-2026-53794 affects versions of rsync prior to 3.5.0.