Executive brief
Rsync is a widely used utility for efficiently transferring and synchronizing files between systems. A vulnerability in how it handles connections through HTTP proxies could allow a malicious proxy or a network attacker to crash the rsync client or cause it to behave unexpectedly. This issue only affects users who have specifically configured rsync to use an HTTP proxy via environment variables.
Technical details
An off-by-one error exists in the establish_proxy_connection() function within socket.c. When rsync is configured to use an HTTP CONNECT proxy (via the RSYNC_PROXY environment variable), it reads the proxy's response into a 1024-byte stack buffer. If the response line exceeds 1023 bytes without a newline terminator, the parser incorrectly increments a pointer based on uninitialized stack data, resulting in a single null byte being written one byte past the end of the buffer. This out-of-bounds write can corrupt adjacent stack memory. Exploitation requires a man-in-the-middle position or control over the proxy server. The vulnerability is fixed in version 3.4.3.
Affected products
- RsyncProject rsync < 3.4.3
Timeline
- 2026-05-19: disclosed
- 2026-05-20: patched: Fixed in rsync version 3.4.3
- 2026-05-20: advisory