Skip to content

GHSA-p827-vwcp-m964 on CTRL-OS 26.05

Aliases: GHSA-p827-vwcp-m964, CVE-2026-53794

Packages: rsync

Status: Plausible

Advisory Information

--max-alloc=0 disabled rsync's per-allocation size cap (the defense behind CVE-2024-12084 and related). A modified or older client could also forward --max-alloc=0 on the wire to an unpatched daemon, which honoured it.

Fix: reject a zero max-alloc both at the client and at the daemon (so an old client forwarding 0 cannot disable the daemon's cap).

Tests: max-alloc-zero-rejected, daemon-max-alloc-zero.

Credit: Azizcan Dastan (Milenium Security).

Affected: rsync 3.4.3 and earlier; fixed in 3.5.0. (Precise introduced-in ranges being finalised.)

Updates

2026-08-14 16:57 CEST

Metadata changes:

  • Status for package rsync: “Plausible”

2026-08-14 16:55 CEST

Metadata changes:

  • Status for package rsync: “New”