Rsync versions 3.1.0 through 3.4.x contain a signed integer overflow in the processing of MSG_IO_TIMEOUT messages. When a malicious host sends an MSG_IO_TIMEOUT packet with a non‑positive value, the internal timeout counter wraps to a non‑positive number and the subsequent timeout check never fires. As a result idle or stalled connections remain open indefinitely, causing the rsync daemon to hold slots and eventually exhaust its available resources. This flaw therefore allows an attacker to trigger a denial‑of‑service condition by keeping daemon sockets busy.

The affected product is RsyncProject's rsync. All releases before 3.5.0 – including the 3.1 work‑branch and all 3.2.x, 3.3.x and 3.4.x series – are impacted. Users running any of those versions should be aware that the vulnerability exists until they upgrade to 3.5.0 or newer.

The CVSS score of 7.1 indicates a moderate severity. No EPSS score is available, but that does not preclude exploitation. Based on the description, it is inferred that attackers can target the rsync daemon over its inbound port, sending crafted MSG_IO_TIMEOUT frames that cause the timeout logic to wrap and prevent the connection from timing out. This allows the attacker to occupy daemon slots indefinitely, eventually exhausting service capacity. The vulnerability is not listed in CISA's KEV catalog, yet its remote exploitability and resource exhaustion impact make it a significant threat to service availability.