Azqzazq1

**Name of the Vulnerable Software and Affected Versions** rsync versions prior to 3.5.0 **Description** A logic error exists in the handling of the `--max-alloc` configuration. When a sender or configuration sets `--max-alloc=0`, allocation sanity checks are entirely disabled instead of enforcing a zero-byte cap. This allows an attacker to force the receiver to perform unbounded memory allocations for data structures and file lists, which can exhaust available memory and lead to a denial of service. **Recommendations** Update rsync to version 3.5.0 or later.