rsync 3.5.0 has been released, addressing 33 CVEs related to critical symlink race conditions, daemon protocol issues, and authentication bypasses. The new secure_relative_open() framework enhances security by preventing out-of-tree symlink hops, which could lead to privilege escalation when rsync runs with elevated privileges. Other fixes target various vulnerabilities in the daemon protocol and include protection against source-address spoofing and a long-standing DoS issue. Users are strongly advised to update to version 3.5.0 immediately, especially if utilizing rsync for CI/CD, cloud backups, or running with root privileges, while also considering potential residual risks on non-Linux platforms

rsync 3.5.0 Drops 33 CVEs, Plugs Critical Symlink Race Conditions

rsync 3.5.0 has arrived, delivering fixes for 33 CVEs across symlink race conditions, daemon protocol flaws, and authentication bypasses. The release introduces secure_relative_open(), a hardened path-resolution framework that pins directory file descriptors and blocks out-of-tree symlink hops. If you run rsync with elevated privileges or rely on it for CI/CD and cloud backups, updating immediately is non-negotiable. Backports for the 3.4.1 and 3.2.7 branches are rolling out alongside the main release this week.

rsync 3.5.0 Drops 33 CVEs, Plugs Critical Symlink Race Conditions @ Linux Compatible