rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation… (CVE-2026-53794)

rsync before version 3.5.0 contains a logic error in the --max-alloc option handling. When a sender or configuration sets --max-alloc=0, the allocation sanity checks are disabled instead of enforcing a zero-byte allocation cap. This allows the receiver to attempt unbounded memory allocations for file lists and data structures, which can exhaust available memory and cause a denial of service condition. The vulnerability affects numerous Ubuntu-specific rsync package versions prior to 3.5.0. The CVSS 3.1 score is 5.3, indicating medium severity. There is no indication of active exploitation in the wild.

The vulnerability allows an attacker controlling the sender side of an rsync transfer or configuration to cause the receiver to allocate excessive memory. This can lead to memory exhaustion on the receiver system, resulting in denial of service. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been documented.

A fix is available in rsync version 3.5.0 and later. Users should upgrade to version 3.5.0 or newer to remediate this vulnerability. Since this is not a cloud service, manual patching or upgrading is required. Patch status is confirmed by the version information indicating the vulnerability is present before 3.5.0 and resolved in 3.5.0. No vendor advisory content contradicts this remediation.