Update bundled rsync from 3.0.7 to a modern supported release (3.2.x)

Feature Request
1

QNAP systems currently ship with:

rsync version 3.0.7 protocol version 30

This version was released in 2009 and lacks many important usability, compatibility, performance, and security improvements available in modern rsync releases.

Request

Please update the bundled rsync package to a current stable upstream version (preferably 3.2.x).

Key Justifications

  1. Better progress stats
    One of the most significant usability limitations is the absence of:--info=progress2

Modern rsync versions provide a single overall transfer progress indicator, which is essential for:

  • Monitoring long-running backups

  • Estimating remaining transfer time

  • Observing total throughput across many files

  • Improving scripting and automation visibility

Without this feature, users only get per-file progress (--progress), which becomes nearly useless when transferring large datasets containing many small files.

Example:
Modern rsync:
rsync -ah --info=progress2 source/ dest/

This provides:

  • overall percentage complete

  • aggregate transfer speed

  • estimated remaining time

  • total bytes transferred

These are now considered standard operational features.

  1. Security and maintenance concerns
    rsync 3.0.7 is extremely old and no longer reflects modern security expectations.

Newer versions include:

  • security fixes

  • protocol hardening

  • improved checksum handling

  • safer daemon behaviour

  • improved compatibility with modern Linux/macOS systems

  1. Performance improvements
    Newer rsync releases provide:

  • faster file-list generation

  • improved incremental recursion

  • better memory handling

  • optional xxhash/zstd compression support

  • improved sparse-file handling

These improvements matter significantly for NAS workloads involving millions of files.

  1. Modern feature support missing from 3.0.7
    Examples of missing or limited functionality include:

  • --info=progress2

  • modern checksum/compression options

  • enhanced partial-transfer handling

  • improved ACL/xattr support

  • newer protocol optimizations

  • better IPv6 handling

  • improved logging/debugging controls

3

Thanks for the suggestion! We plan to update the rsync version in a future release, primarily as part of the QTS/QuTS hero 6 update.

1 Like
4

Well here we are. QuTS 6 is out and I’ve installed it on a test box.

Still on 3.0.7

5

Sorry for the confusion! To clarify, we didn’t mean that the rsync update would be included in the first release of QuTS hero 6. Rather, our PM will include this update in the scope of a future release, and the specific timeline is currently being planned. Thanks for your suggestion!

6

Hi @SteveKo ,

I just want to re-emphesise the importance of getting this fixed sooner than later. v3.0.7 is seriously vulnerable, and poses a risk to our data and security. For example,

  • CVE-2014-9512: a malicious server can write files outside the intended destination (fixed in 3.1.2).

  • CVE-2016-9840 to 9843: zlib bugs in the bundled copy (fixed in 3.1.3).

  • CVE-2017-16548, 17433, 17434, and CVE-2018-5764: receiver and daemon argument and checksum handling flaws (fixed in 3.2.0).

  • CVE-2022-29154: a malicious server can write arbitrary files on the client (fixed in 3.2.5).

  • CVE-2024-12085 to 12088 and 12747 (fixed in 3.4.0): information leak, path traversal, --safe-links bypass and a symlink race.

  • CVE-2026-53791 (CRITICAL rating).

  • CVE-2026-41035 is a use-after-free in xattr handling. The reporter’s timeline says it was introduced in rsync 3.0.1, so your 3.0.7 has it, and your build lists xattr support. The maintainer’s view was that it’s mostly a way for the client to crash its own connection, though the impact of a malicious server was still being assessed. openwallopenwall

  • Version 3.4.3 (20/05/2026) fixed six CVEs, all affecting 3.4.2 and earlier. They include a daemon hostname ACL bypass (CVE-2026-43617, rated moderate) and an off-by-one stack write that needs RSYNC_PROXY set (CVE-2026-45232).

  • Version 3.5.0 (13/08/2026) is described as a major security release. The list of fixes includes over 30 CVEs, with roughly 20 rated HIGH.

  • Red Hat’s advisory shows the kinds of bugs involved. These include command injection via multiple code paths, heap out-of-bounds write via a crafted argument list, memory corruption via crafted file entries, arbitrary file read, write and delete, an auth users authorisation bypass, and a rrsync directory escape.

Thanks.

7

Hi Sam . :nerd_face:

While you wait, there’s a later rsync available via Entware:

[~] # opkg info rsync
Package: rsync
Version: 3.4.1-3
Depends: libc, libssp, librt, libpthread, libpopt, zlib, libattr, libacl, libzstd, libiconv-full
Provides: rsync-any
Status: unknown ok not-installed
Section: net
Architecture: x64-3.2
Size: 238004
Filename: rsync_3.4.1-3_x64-3.2.ipk
Description: rsync is a program that allows files to be copied to and from remote machines
 in much the same way as rcp. It has many more options than rcp, and uses the
 rsync remote-update protocol to greatly speed up file transfers when the
 destination file already exists.
 
 The rsync remote-update protocol allows rsync to transfer just the differences
 between two sets of files across the network link.
8

Thanks! Good to know.