← Friday, October 2, 2026SecurityVulnerability

Debian upgrades rsync to 3.5.0 to address 33 CVEs

lobste.rs 6 min read Editor score 7/10

Debian chose a version upgrade over backporting 33 CVE fixes, citing lower risk; the update also changes handling of operator-supplied paths through untrusted symlinks. Operators should review compatibility implications before upgrading.

What

Debian upgraded rsync to 3.5.0 to address 33 CVEs rather than backporting the fixes individually.

How

The update changes behavior, including refusing untrusted symlinks and tightening rsyncd access and certificate checks.

Why it matters

Engineers should review compatibility-sensitive changes when updating systems that rely on rsync.

Read on lobste.rs → Lobsters · 10 comments

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.