Release v3.5.0 · RsyncProject/rsync · GitHub

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

• CVE-2026-53789rsync < 3.5.0 Arbitrary File Deletion via Malicious File List
• CVE-2026-53784rsync < 3.5.0 Path Traversal via Symlink Module Root
• CVE-2026-53786rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive
• CVE-2026-53795rsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-dest
• CVE-2026-70459rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry
• CVE-2026-70455rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion
• CVE-2026-53791rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header
• CVE-2026-53799rsync < 3.5.0 Symlink Race Condition via ACL/xattr Application
• CVE-2026-70463rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing
• CVE-2026-70461rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry
• CVE-2026-70457rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg()
• CVE-2026-53803rsync < 3.5.0 Symlink Following Arbitrary File Overwrite
• CVE-2026-53802rsync < 3.5.0 Arbitrary File Read via Symlink Following
• CVE-2026-53801rsync < 3.5.0 Symlink Race Condition Directory Traversal
• CVE-2026-53800rsync < 3.5.0 Symlink Race Condition via --remove-source-files
• CVE-2026-53798rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping
• CVE-2026-53797rsync < 3.5.0 Symlink Race Condition Information Disclosure

Source and provenance

Original title: Release v3.5.0 · RsyncProject/rsync · GitHub. Captured 27 Sept 2026, 20:00 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.