Skip to content

GHSA-p827-vwcp-m964

CVE Information

--max-alloc=0 disabled rsync's per-allocation size cap (the defense behind CVE-2024-12084 and related). A modified or older client could also forward --max-alloc=0 on the wire to an unpatched daemon, which honoured it.

Fix: reject a zero max-alloc both at the client and at the daemon (so an old client forwarding 0 cannot disable the daemon's cap).

Tests: max-alloc-zero-rejected, daemon-max-alloc-zero.

Credit: Azizcan Dastan (Milenium Security).

Affected: rsync 3.4.3 and earlier; fixed in 3.5.0. (Precise introduced-in ranges being finalised.)