The vulnerability is a null pointer dereference in the rsync daemon child process that occurs when the daemon processes a file list whose first entry is a dot entry that is incorrectly treated as a directory. This causes the daemon to dereference an invalid or uninitialized pointer and terminate the client connection, resulting in a denial of service. The flaw is classified as CWE-908.

Vendor RsyncProject. Product rsync. Affected versions include all releases from rsync 3.0.0 through 3.4.x. Any rsync instance that is running a susceptible version and exposed to external hosts can be impacted.

The CVSS score of 6.9 denotes a medium severity, with a remote attack vector that can cause service disruption. The EPSS score is not available, so the current probability of exploitation remains unclear, and the vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the crash by initiating a sync operation with a crafted file list from a remote host, potentially bringing the rsync daemon down for that session. The impact is restricted to availability; there is no known code execution or data disclosure.