rsync 3.5.2 fixes interrupted-transfer corruption and a CPU exhaustion flaw

If rsync powers your backups or sync jobs, this is an update worth applying. Version 3.5.2, released on November 4, fixes a bug that could corrupt files when an interrupted transfer resumed, and patches a vulnerability that lets a malicious receiver exhaust the sender's CPU.

The interrupted-transfer fix

The most consequential change for everyday use concerns the --append and --inplace options, commonly used for large backups, disk images and virtual machine files. According to the official release notes, an interrupted transfer could write the final 256 KiB buffer twice, leaving the destination file damaged. With 3.5.2, an interrupted destination remains a clean prefix that the next transfer can resume or repair correctly. If you run rsync over flaky connections, this one was quietly working against you.

The security fix

CVE-2026-119741 is a CPU exhaustion issue: a malicious receiver can supply weak checksums that collide with consecutive rolling windows, forcing the sender to perform excessive strong-checksum calculations. The new release bounds that work. The scenario mainly matters when you synchronize with endpoints you do not control - less common than the corruption bug above, but worth closing.

What else is new

Two new options join the toolbox: --nice adjusts CPU and I/O scheduling priorities for local and remote rsync processes (daemon clients and restricted setups cannot raise server-side priorities), and --delay-symlinks defers creating new or changed symlinks until the other transferred files are in place. Matching performance on large sparse or repeated-block files is improved, a daemon receiver stack overflow is fixed, and human-readable output gets three significant digits, proper binary unit suffixes and thousands separators.

Getting it

The release notes and downloads are on the rsync site, and distribution packages should follow shortly. If your backup scripts lean on --append or --inplace, do not wait for the next failed transfer to remind you.

Sources: rsync NEWS (official release notes), Help Net Security, Linuxiac.

Cover: rsync output running from the Grsync frontend (Wikimedia Commons, GPL v2+ / public domain). It shows an older rsync version in action, not 3.5.2.