CVE-2026-53794

A flaw was found in rsync. A logic error in the --max-alloc handling allows a remote attacker to disable memory allocation sanity checks by setting --max-alloc=0. This can lead to the receiver attempting unbounded memory allocations, potentially exhausting available memory and causing a denial of service.

This vulnerability in rsync is rated as Important. A remote attacker can exploit a logic error in the --max-alloc handling by providing --max-alloc=0, which disables memory allocation sanity checks. This can lead to unbounded memory consumption on the receiving system, resulting in a denial of service without requiring authentication or user interaction. Red Hat systems using rsync, particularly in daemon mode or when processing untrusted data, are at risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid using the --max-alloc=0 option in rsync configurations or command-line arguments. If rsync is operating as a daemon, ensure that its configuration does not include --max-alloc=0. For rsync clients, refrain from using --max-alloc=0 when synchronizing with untrusted sources. This mitigation prevents the disabling of memory allocation sanity checks, thereby avoiding unbounded memory consumption. If rsync is running as a service, a restart may be required for configuration changes to take effect.