The vulnerability in rsync prior to version 3.5.0 arises from a logic error in how the --max-alloc parameter is processed. Instead of enforcing a zero-byte cap, the implementation permits a sender or configuration setting of --max-alloc=0 to disable allocation safety checks entirely. This allows an attacker to coax the receiver into allocating memory without bounds, potentially exhausting system memory and resulting in a denial of service.

The flaw affects the rsync project’s software, specifically all releases older than 3.5.0. Systems running these versions on any supported operating system are at risk if rsync is exposed to untrusted input or if the --max-alloc option is configured to 0. Current releases 3.5.0 and later contain the fix.

The CVSS score of 6.9 indicates a moderate severity. The exploit probability is unknown because EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via the rsync protocol starter from a malicious sender or via a compromised configuration. Triggering the exploit requires the ability to send a carefully crafted rsync request with --max-alloc set to 0 or allowing a configuration file to specify that value. Successful exploitation would lead to unbounded memory allocation that could kill the rsync process and potentially other services running on the same host, causing a denial of service.