diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix
index 5265faf87b6f..0b3343b67314 100644
--- a/pkgs/applications/networking/sync/rsync/default.nix
+++ b/pkgs/applications/networking/sync/rsync/default.nix
@@ -20,7 +20,12 @@ stdenv.mkDerivation rec {
   };
 
   srcs = [mainSrc] ++ stdenv.lib.optional enableCopyDevicesPatch patchesSrc;
-  patches = [] ++ stdenv.lib.optional enableCopyDevicesPatch "./patches/copy-devices.diff";
+  patches = [(fetchurl {
+      url = "https://git.samba.org/?p=rsync.git;a=commitdiff_plain;h=0dedfbce2c1b851684ba658861fe9d620636c56a";
+      sha256 = "1jpwwdf07naqxc8fv1lspc95jgk50j5j3wvf037bjay2qzpwjmvf";
+      name = "CVE-2014-2855.patch";
+    })]
+    ++ stdenv.lib.optional enableCopyDevicesPatch "./patches/copy-devices.diff";
 
   buildInputs = stdenv.lib.optional enableACLs acl;
   nativeBuildInputs = [perl];