CyberRota Analysis
AI-GeneratedRsync versions prior to 3.5.0 are vulnerable due to a logic error in the handling of the --max-alloc option, which can lead to the disabling of allocation sanity checks. This flaw allows attackers to exploit the system by triggering unbounded memory allocations, potentially resulting in denial of service through memory exhaustion. Organizations using affected versions of rsync should prioritize patching to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory allocations for file list and data structures, potentially exhausting available memory and causing a denial of service.