CVE-2026-45232

3.1 LOW

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in...

Published: 2026-05-20 · Last updated: 2026-05-21

Severity and scoring

CVSS: 3.1 LOW
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE: CWE-193

Affected products

Vendor	Product
samba	rsync

Description

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.

Source: NVD

References

Related CVEs

Same vendor

CVE-2026-4408 — A flaw was found in Samba (9.0 CRITICAL)
CVE-2026-2340 — A flaw was found in Samba’s vfs_worm module (6.5 MEDIUM)
CVE-2026-1933 — A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes (7.1 HIGH)
CVE-2026-3012 — A flaw was found in Samba’s certificate auto-enrollment Group Policy handling (8.0 HIGH)
CVE-2026-4480 — A flaw was found in the Samba printing subsystem (9.0 CRITICAL)

Same CWE

CVE-2026-46559 — ImageMagick is free and open-source software used for editing and manipulating digital images (4.0 MEDIUM)
CVE-2026-45380 — bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files (3.6 LOW)
CVE-2026-45358 — ImageMagick is free and open-source software used for editing and manipulating digital images (5.3 MEDIUM)
CVE-2026-49127 — Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pc... (8.6 HIGH)
CVE-2026-42015 — A flaw was found in gnutls (5.3 MEDIUM)