Rsync 3.5 has been released today as a major update to the widely used open-source file synchronization and transfer utility, addressing 33 vulnerabilities, including one rated Critical and numerous High-severity flaws.
At the top of the list is CVE-2026-53791, rated Critical, affecting rsync daemons configured with proxy protocol = true. Previously, a client connecting directly to the daemon instead of through the expected trusted proxy could supply its own PROXY header, spoof its source IP address, and potentially bypass host-based access controls.
A significant portion of the remaining fixes deals with symlink handling and path confinement. Several High-severity vulnerabilities could allow attackers to redirect rsync operations outside their intended directories, resulting in arbitrary file reads or writes, information disclosure, or privilege escalation under certain configurations.
Other fixes tighten confinement around --relative, --temp-dir, --link-dest, ACL and extended-attribute handling, directory enumeration, and --remove-source-files. The restricted SSH wrapper rrsync has also received additional protections against directory escapes and unsafe options.
Rsync 3.5 also addresses several memory-safety issues reachable through the daemon protocol. These include heap out-of-bounds writes in filter processing, argument parsing, and hard-link handling. The vulnerabilities were uncovered during daemon-protocol fuzzing and can be triggered remotely through specially crafted protocol data.
The release also fixes quadratic CPU exhaustion caused by specially crafted checksum chains. It strengthens hosts deny behavior so unresolved deny entries fail closed instead of allowing access and corrects parsing of certain auth users rules. Peer-supplied --partial-dir and --backup-dir paths are now confined to prevent symlink-based escapes from the daemon module root.
On the client side, rsync 3.5 fixes a vulnerability that could allow a malicious peer to manipulate the client’s I/O timeout. More importantly for users relying on encrypted rsync connections, rsync-ssl now performs proper certificate verification and hostname binding when using stunnel unless an explicit insecure opt-out is requested.
Beyond the CVE fixes, the developers introduced additional security hardening. Control characters in filenames are now escaped before being written to logs to prevent terminal and log injection. A --safe-links bypass involving backups has been closed, proxy headers are length-limited, and several integer-overflow and memory-safety paths have received additional checks.
Finally, some behavior changes accompany the stronger security model. A non-daemon receiver will now follow an operator-specified symlinked destination directory only when that symlink is owned by root or by the user running rsync. Additionally, configuring proxy protocol = true without specifying trusted proxy protocol hosts now causes connections to be rejected rather than accepted.
For more information, refer to the official release notes.
Given the scope and severity of the vulnerabilities addressed, users and administrators are advised to upgrade to version 3.5 as soon as packages become available for their distros.
