CVE-2026-53794 is a vulnerability in rsync before version 3.5.0 where a logic error in the --max-alloc parameter handling allows a sender or configuration to set --max-alloc=0, which disables allocation sanity checks instead of enforcing a zero-byte allocation limit. This flaw can be exploited to cause the receiver to allocate unbounded amounts of memory for file lists and data structures, potentially exhausting system memory and causing a denial of service condition.

An attacker can cause the rsync receiver to consume excessive memory resources by exploiting the improper validation of the --max-alloc parameter. This can lead to denial of service through memory exhaustion on the target system. There is no indication of privilege escalation, code execution, or data corruption from the provided data.

No official patch or remediation level is currently confirmed. Users should monitor vendor advisories for updates. Until a fix is available, avoid using untrusted senders or configurations that set --max-alloc=0. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.