CVE-2026-45232: Rsync off-by-one stack write in establish_proxy_connection

CVE-2026-45232 · Severity: low · CVSS 3.1 · Published 2026-05-20

Rsync is a widely used utility for efficiently transferring and synchronizing files between systems. A vulnerability in how it handles connections through HTTP proxies could allow a malicious proxy or a network attacker to crash the rsync client or cause it to behave unexpectedly. This issue only affects users who have specifically configured rsync to use an HTTP proxy via environment variables.

Technologies: RsyncProject Rsync. Vendors: RsyncProject.

Quick answers

Is CVE-2026-45232 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45232 being exploited in the wild.
How severe is CVE-2026-45232?
Low severity, with a CVSS score of 3.1, published 20 May 2026.
Which products and versions are affected?
RsyncProject Rsync < 3.4.3.
Is there a fix for CVE-2026-45232?
A patch was published on 2026-05-20: Fixed in rsync version 3.4.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45232 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45232?
Check whether you run RsyncProject Rsync at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An off-by-one error exists in the establish_proxy_connection() function within socket.c. When rsync is configured to use an HTTP CONNECT proxy (via the RSYNC_PROXY environment variable), it reads the proxy's response into a 1024-byte stack buffer. If the response line exceeds 1023 bytes without a newline terminator, the parser incorrectly increments a pointer based on uninitialized stack data, resulting in a single null byte being written one byte past the end of the buffer. This out-of-bounds write can corrupt adjacent stack memory. Exploitation requires a man-in-the-middle position or control over the proxy server. The vulnerability is fixed in version 3.4.3.

Affected products

  • RsyncProject rsync < 3.4.3

Timeline

  • 2026-05-19: disclosed
  • 2026-05-20: patched: Fixed in rsync version 3.4.3
  • 2026-05-20: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.