rsync 3.5.0 Fixes 33 CVEs, Including a Critical Proxy-Spoofing Flaw, as Outside Researchers Join the Project's Admin Team

Overview

The rsync project released version 3.5.0 on August 13, 2026, fixing 33 security issues in a single, sweeping release, according to the project’s official NEWS file. Andrew Tridgell announced the release on the oss-security mailing list under the subject “rsync 3.5.0 released with fixes for 33 CVEs,” writing, “We have just released rsync 3.5.0. This release addresses 33 CVEs,” according to the oss-security posting. LWN.net independently confirmed the count, reporting that the release “fixes 33 security issues found during a focused audit of rsync’s path handling and daemon protocol, a companion daemon-protocol fuzzing pass, and reports from external researchers.” GitHub’s release page for the version, tagged August 13 at 00:30, describes it simply as “a major security release”.

rsync is one of the most widely deployed file-synchronization tools in the Unix world, underpinning backup systems, package mirrors, and deployment pipelines, which is why a release addressing three dozen vulnerabilities at once is a significant event for the broader open-source infrastructure it supports.

A promised follow-up to a disruptive spring

The release fulfills a commitment Tridgell made after a difficult stretch earlier in 2026. As previously reported, rsync 3.4.3 shipped on May 20 with fixes for six CVEs, but the changes broke working backup configurations, forcing a fast cleanup release, 3.4.4, on June 8. At the time, Tridgell said “there will be an rsync 3.5.0 soon, with many more security updates” and said he had created a dedicated rsync-security@lists.samba.org mailing list for testing ahead of the 3.5.0 release, according to LWN. Version 3.5.0 is that release, arriving roughly two months later with far more fixes than the six that caused the earlier disruption.

What the release fixes

According to the NEWS file, the 33 issues span several categories. The most severe, CVE-2026-53791, is rated CRITICAL. The rsync project describes it as a flaw in which, “with proxy protocol = true, a client connecting directly (not via the trusted proxy) could send a PROXY header to spoof its source address and bypass host-based access control,” a defect now fixed so that “a forwarded address is now honoured only from a configured trusted-proxy peer,” per the NEWS file. NVD’s entry for the flaw describes it as an “IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls,” affecting “rsync versions 3.4.4 and earlier,” with a CNA-assigned CVSS score of 9.1.

Many of the remaining issues involve symlink races — a local or remote party planting a symlink that a privileged rsync process then follows. CVE-2026-53802, rated HIGH, covers cases where rsync “followed attacker-planted symlinks” in filter files, --files-from lists, and password files, allowing an attacker to read an arbitrary file or exfiltrate daemon authentication data, the NEWS file states. Its counterpart, CVE-2026-53803, also HIGH, covers symlinked output paths such as --log-file and --write-batch that could let an attacker redirect writes — for example, appending to an authorized_keys file, per the same source. The rrsync restricted-SSH wrapper had its own escape, CVE-2026-53783, in which argument validation via realpath() and a subsequent exec created a time-of-check-to-time-of-use window that could let a restricted user break out of their assigned directory, the NEWS file notes.

Not every fix addressed a newly discovered flaw. CVE-2026-70453, a HIGH-severity quadratic CPU-exhaustion bug in the hash_search() function, “was already public and was not embargoed,” having first been reported as a performance problem in a public rsync issue in 2021 before the project’s security team recognized it as a security issue this cycle, according to the NEWS file. Separately, CVE-2026-70455 — a flaw allowing a daemon client to request an excessive number of compression worker threads via --compress-threads — was “reported, fixed and tested by Filipe Casal of Trail of Bits, in collaboration with OpenAI,” per the same document.

The NEWS file states that CVE identifiers for the release “were assigned by VulnCheck (CNA)” and that “every fix ships with a regression test in the test suite that fails on the unfixed tree,” according to the rsync project. Tridgell also told the oss-security list that backport patch sets for the older 3.2.7 and 3.4.1 branches “were sent to distros@…openwall.org last week” ahead of the public release, according to his posting.

An expanded admin team

The release notes also mark a governance shift for the project. Tridgell wrote that he is “particularly grateful to Zen Dodd (Tao), Omar Elsayed (seks99x), Will Sargeant, Paul Mackerras, Aleksa Sarai and Leonid Bugaev (buger) who joined the rsync admins group helping to triage all the issues, develop new tests, review PRs and helped develop the guidelines we used for where to draw the line between a security issue and expected behaviour,” according to the NEWS file. He separately thanked Filipe Casal of Trail of Bits, who “worked with us on the ‘Patch the Planet’ program” and “provided a huge trove of valuable tests and security reports,” as well as Greg Kroah-Hartman “for invaluable advice and security reports” and Stuart Inglis “for particularly high quality bug reports and testing,” per the same source.

What We Don’t Know

The NEWS file does not disclose whether any of the 33 vulnerabilities were exploited in the wild before being patched, nor does it give a timeline for how long the audit and fuzzing effort took beyond describing it as developed “over several months.” It also isn’t clear how many of the CVEs will receive independent NVD analyst scores beyond the CNA-assigned figures the project cites, since NVD’s own assessment of CVE-2026-53791 had not yet been published at the time of the release.