- A total of 12 security vulnerabilities were found in rsync across two batches (January 2025 and May 2026).
- Go's memory safety (bounds checks, zero initialization) and the os.Root API prevent or mitigate most vulnerabilities.
- gokrazy/rsync's minimal implementation avoids 8 of 12 vulnerabilities simply by not implementing vulnerable features.
- OpenBSD's openrsync also avoids many vulnerabilities due to minimalism and defense-in-depth (unveil, pledge).
- Defense in depth on Linux includes mount namespaces, systemd hardening, Landlock, and Go's os.Root API.
- All known vulnerabilities are fixed in gokrazy/rsync v0.3.3+ and upstream rsync 3.4.3+.
- The article concludes that lacking validation and complexity are primary causes of vulnerabilities.
- Simple use cases should use simple implementations to reduce attack surface.