The rsync project has released version 3.5.0, a major update that resolves 33 security vulnerabilities identified through a targeted audit of the utility’s path handling and native daemon protocol. Published on August 13, 2026, the release also introduces several robustness hardenings, marking one of the most concentrated security efforts in the file synchronization tool’s recent history.
According to the official release notes, the vulnerabilities were uncovered through a multi-stage review process. The development team combined a focused examination of path resolution logic with a dedicated daemon-protocol fuzzing campaign, alongside coordinated vulnerability reports from external researchers. The patched issues primarily impact rsync’s standalone daemon mode, which manages network transfers independently of SSH encryption. CVE identifiers have been assigned to the resolved flaws.
The audit methodology highlights a shift toward deeper, protocol-level security testing in open-source maintenance. By supplementing standard continuous integration checks with manual code review and targeted fuzzing, the maintainers were able to identify latent logic errors that automated testing pipelines typically miss. The release notes detail how these findings were addressed alongside broader stability improvements to the codebase.
Version 3.5.0 is now available for download. Given the scope of the security patches and the underlying adjustments to path handling and protocol robustness, administrators managing rsync daemons are expected to review the updated release documentation and verify that existing configurations align with the revised security baselines.
rsync 項目已發佈 3.5.0 版本，此重大更新修補了透過針對性審計該工具的路徑處理及原生 daemon 協議所發現的 33 個安全漏洞。該版本於 2026 年 8 月 13 日發佈，同時引入多項穩健性強化措施，成為該文件同步工具近年最集中的安全改善工作之一。
根據官方發佈說明，是次漏洞透過多階段審查程序揭發。開發團隊結合了對路徑解析邏輯的集中審查、專門的 daemon protocol fuzzing 測試，以及外部研究人員協調提交的漏洞報告。已修補的問題主要影響 rsync 的獨立 daemon 模式，該模式負責管理網絡傳輸，且不依賴 SSH 加密。已解決的缺陷均已獲分配 CVE 識別碼。
是次審計方法突顯開源軟件維護工作正轉向更深入、協議層級的安全測試。透過在標準 CI 檢查之上加入人手程式碼審查及針對性 fuzzing，維護團隊成功找出自動化測試 pipeline 通常遺漏的潛在邏輯錯誤。發佈說明詳細交代了團隊如何處理這些發現，並同時對 codebase 進行更廣泛的穩定性改善。
3.5.0 版本現已可供下載。鑑於安全修補的範圍，以及對路徑處理和協議穩健性的底層調整，管理 rsync daemon 的管理員應審閱更新後的發佈文件，並驗證現有設定是否符合修訂後的安全基準。