PT-2026-71655 · Rsync · Rsync
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
rsync versions 3.4.2 through 3.4.x
Description
A denial of service issue exists where a remote sender can exhaust system resources on the receiver. This occurs because the short alias
--zt for the --compress-threads option bypasses the string matching of the refuse options directive, which only checks long option names. An attacker can provide a large value for the --zt variable to spawn an unbounded number of Zstandard worker threads, leading to the exhaustion of available memory and thread resources.Recommendations
Update rsync to version 3.5.0.
Exploit
Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Rsync