rsync v3.2.8 released

rsync is the classic Unix tool for fast, incremental file transfers - backups, mirrors and deployments over SSH or the rsync daemon.

v3.2.8 is the first release of the new 3.2 LTS line. It supersedes 3.2.7 and the temporary 3.2.7-sec-patches* snapshots, ships no new features, and keeps protocol 31.

The release backports the security fixes from 3.4.3, 3.5.0 and 3.5.2 - dozens of CVEs, from CVE-2026-29518 up to CVE-2026-119741. Everything not needed for compatibility with the old line should be handled by moving to the current stable release instead.

Highlights:

Paths for sources, destinations, daemon modules, partial/backup dirs and config files stay inside their intended roots
rrsync restricted directories hardened with inode-bound descriptor paths, failing closed without /proc/self/fd support
Malformed argument lists, indices, checksum blocks, xattr data, proxy responses and handshakes are rejected or bounded
Daemon access control, filters, delete scope, PROXY-protocol trust and shell-hook quoting fixed
rsync-ssl now verifies certificate chain and hostname unless the explicit insecure opt-out is used
New --insecure-links option and daemon "insecure links" setting for deployments that need the old symlink behaviour

See the 3.2.8 NEWS entry for the complete list of changes and security fixes.

Happy syncing! :-)

• News
• Tools