From the maintainter's webpage (http://zsync.moria.org.uk/):
This is just a bugfix release. Someone noticed that zsync would be
vulnerable to CAN-2005-2096, due to it's use of zlib code. So the
patch for that is now done.
This release also includes some HTTP protocol fixes, as there have
been some complaints/observations on how zsync failed to correctly
implement some details from the standard.