A flaw in rsync versions prior to 3.5.0 allows a remote participant to exhaust system resources by specifying the short --zt alias for --compress-threads. By providing a large value for --zt, an attacker can cause the receiver to spawn an unlimited number of Zstandard worker threads, consuming CPU, memory, and thread pool capacity and ultimately rendering the service unavailable.

The vulnerability affects all rsync installations from 3.4.2 through any 3.4.x release, i.e., rsync 3.4.2 < 3.5.0. The issue is present in the core rsync daemon regardless of other configuration options.

With a CVSS score of 8.7 the flaw represents a high severity denial of service risk. Exploitation requires remote access to the rsync daemon and the ability to specify a sync command with the --zt option. No EPSS score is available, but the flaw is not yet listed in the CISA KEV catalog. Attackers who can control the sender side of a sync can trigger the resource exhaustion and disrupt availability of the target system.