CVE-2026-45232
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Rsync versions before 3.4.3 have an off-by-one stack write vulnerability in establish_proxy_connection(). A network attacker can corrupt stack memory by sending a malformed HTTP proxy response, writing a null byte out of bounds.
Risk Assessment
An attacker controlling the proxy or positioned between client and proxy can corrupt memory, potentially causing a crash or arbitrary code execution.
Recommendation
Upgrade rsync to version 3.4.3 or later. In proxy environments, restrict trust to proxy servers.
Original NVD description (English source)
Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.