The latest release of Rsync 3.5.0 has been published, offering users a file synchronization and backup utility that helps minimize traffic by incrementally copying changes. Users have the option to use ssh, rsh, or the rsync protocol for transport. Additionally, Rsync supports the organization of anonymous rsync servers, which are ideal for ensuring the synchronization of mirrors.
The project code for Rsync is distributed under the GPLv3 license. This new version is particularly noteworthy for its focus on strengthening security and addressing 33 vulnerabilities, the majority of which were discovered during the audit of file path processing and protocol implementation. One vulnerability was deemed critical, 17 were categorized as high, and 15 were considered medium-risk.
Some of the fixed issues in this release include a critical vulnerability in the protocol implementation that could allow spoofing IP addresses when working in “proxy protocol = true” mode (CVE-2026-53791). There was also a vulnerability related to the substitution of additional commands and arguments when calling external commands through various methods (CVE-2026-53790).
Other vulnerabilities addressed in this release involve problems with out-of-bounds writes, incorrect handling of hard links, and issues related to symbolic links. These vulnerabilities could potentially allow a local user to manipulate files or directories referenced by options when running a privileged rsync process, leading to unauthorized reading and writing of files in the file system, as well as directory traversal.
Another vulnerability addressed in this release involves an out-of-bounds base directory when using the rrsync wrapper, allowing attackers to replace the path with a symbolic link between verification and actual use.