TLDR Tech / InfoSec
How my minimal, memory-safe Go rsync steers clear of vulnerabilities
Examining all 12 rsync CVEs from the January 2025 and May 2026 batches, the author shows that gokrazy/rsync, a minimal Go reimplementation, avoided 8 of them purely by not implementing the vulnerable features (incremental recursion, compression, proxy support, and hostname ACLs) and that Go's structural defenses neutralized most of the rest: runtime bounds checks convert heap overflows into panics, zero-initialization eliminates stack info leaks, and the traversal-resistant os.Root API closes the TOCTOU symlink races, leaving only one logic bug (CVE-2026-43617) that the language could not have prevented. The practical takeaways are to upgrade to rsync 3.4.3+ or gokrazy/rsync v0.3.3+, layer in defense-in-depth via mount namespaces, systemd hardening, or Landlock, and prefer implementations whose complexity is proportional to the use case, since avoiding unneeded protocol features measurably shrinks the attack surface.
Read the full story