Rsync 3.5.2, the latest maintenance update to the widely used open-source file synchronization and transfer utility, is now available.
One important fix addresses CVE-2026-119741, a vulnerability involving excessive checksum processing. A malicious receiver could supply weak checksums that collide repeatedly with consecutive rolling windows, causing the sender to perform excessive strong-checksum calculations.
Another notable fix concerns interrupted transfers using the --append and --inplace options. Previously, an interrupted transfer could write the final 256 KiB buffer twice. This correction ensures interrupted destination files retain a clean prefix, allowing subsequent transfers to resume or repair them correctly.
Rsync 3.5.2 also improves matching performance when synchronizing large sparse files or files with repeated data. The previous implementation struggled when duplicate checksum chains exhausted the search limit, preventing valid matching blocks from being found.
Moreover, the release introduces the --nice option, allowing users to adjust CPU and I/O scheduling priorities for both local and remote Rsync processes. However, daemon clients and restricted Rsync environments cannot increase server-side priorities.
Another addition is --delay-symlinks, which postpones creating new or modified symbolic links until other transferred files are in place. It also disables incremental recursion and cannot be combined with several options, including --remove-source-files, --hard-links, and various destination-comparison options.
The update also fixes a daemon receiver stack overflow that could occur when queued deletion output reached the configured --max-alloc limit. Quiet daemon transfers now avoid queuing deletion messages unless explicitly requested by the client.
Hard-link handling has been corrected as well. Previously, a failed hard-link creation could abort or hang the generator. Rsync now recovers from such failures by allowing remaining files to form a new hard-link group when the original destination inode cannot accept more links.
Other fixes address uploads through restricted Rsync environments when destination files exist, an out-of-bounds write related to checksum invalidation, and a --files-from issue that could cause files to be read from the wrong daemon module directory.
The release also improves how transfer statistics are displayed. Human-readable values now use three significant digits, binary units include the “i” suffix, and progress output explicitly identifies byte counts and transfer rates using B and B/s. Thousands separators have been added to several counters.
Finally, Rsync 3.5.2 includes fixes for password files beginning with an empty line, terminal control characters in filenames and diagnostics, IPv6 hostname-based daemon access rules, Unix socket activation, symlink permissions, Cygwin and MSYS2 UNC paths, and compatibility with older systems such as Solaris 10.
For more information, see the release notes.
