CVE-2026-45232

The record

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.

Affected packages

Related vulnerabilities

• CVE-2026-29518 Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race… Also affects rsync
• CVE-2026-43620 Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read… Also affects rsync
• CVE-2026-43618 Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the… Also affects rsync
• CVE-2026-43619 Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in… Also affects rsync
• CVE-2026-43617 Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync… Also affects rsync
• CVE-2026-41035 In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a… Also affects rsync
• CVE-2025-10158 A malicious client acting as the receiver of an rsync file transfer can trigger an out of… Also affects rsync
• CVE-2024-12084 A heap-based buffer overflow flaw was found in the rsync daemon. Also affects rsync