Every CVE Search/ Get API key

CVE-2026-45232

Rsync < 3.4.3 Off-by-One Stack Write via HTTP Proxy

2.1 LowFix available

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Active

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.34%Up 0.3 points since May 20, 2026
90%50%10%1%

What each source reports

CVE List Score used 2.1

Rsync < 3.4.3 Off-by-One Stack Write via HTTP Proxy

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.

Record
CVE-2026-45232
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-193
Updated
2026-11-02
EUVDEUVD-2026-31009 2.1

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.

Record
EUVD-2026-31009
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
NVD 2.1

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.

Record
CVE-2026-45232
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-193
Updated
2026-11-02
OSVALPINE-CVE-2026-45232 3.7

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.

Record
ALPINE-CVE-2026-45232
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVBELL-CVE-2026-45232 3.7
Record
BELL-CVE-2026-45232
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSV 2.1

Rsync < 3.4.3 Off-by-One Stack Write via HTTP Proxy

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.

Record
CVE-2026-45232
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-193
Updated
2026-11-02
Show 21 moreShow less
OSVDEBIAN-CVE-2026-45232 3.7

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.

Record
DEBIAN-CVE-2026-45232
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVJLSEC-2026-632 2.1

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.

Record
JLSEC-2026-632
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-2502 8.1

rsync security update

Rsync is an open source utility that provides fast incremental file transfer. It uses the &quot;rsync algorithm&quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.(CVE-2026-43618)

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.(CVE-2026-45232)

Record
OESA-2026-2502
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2503 8.1

rsync security update

Rsync is an open source utility that provides fast incremental file transfer. It uses the &quot;rsync algorithm&quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.(CVE-2026-43618)

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.(CVE-2026-45232)

Record
OESA-2026-2503
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2504 8.1

rsync security update

Rsync is an open source utility that provides fast incremental file transfer. It uses the &quot;rsync algorithm&quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.(CVE-2026-43618)

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.(CVE-2026-45232)

Record
OESA-2026-2504
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2505 8.1

rsync security update

Rsync is an open source utility that provides fast incremental file transfer. It uses the &quot;rsync algorithm&quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.(CVE-2026-43618)

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.(CVE-2026-45232)

Record
OESA-2026-2505
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2550 8.1

rsync security update

Rsync is an open source utility that provides fast incremental file transfer. It uses the &quot;rsync algorithm&quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.

Security Fix(es):

Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.(CVE-2026-43618)

Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client.(CVE-2026-43620)

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.(CVE-2026-45232)

Record
OESA-2026-2550
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-45232 2.1

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.

Record
UBUNTU-CVE-2026-45232
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVAZL-86997 No score

CVE-2026-45232 affecting package rsync for versions less than 3.4.3-1

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.

Record
AZL-86997
Updated
2026-11-02
OSVCLSA-2026-1780922909 No score

rsync: Fix of CVE-2026-45232

  • CVE-2026-45232: fix off-by-one out-of-bounds stack write in establish_proxy_connection() by rejecting an over-long HTTP proxy response line
Record
CLSA-2026-1780922909
Updated
2026-11-02
OSVCLSA-2026-1782981361 No score

rsync: Fix of CVE-2026-45232

  • CVE-2026-45232: fix off-by-one out-of-bounds stack write in establish_proxy_connection() when a malicious HTTP proxy returns an over-long response line without a newline; reject the buffer-full case instead of writing the NUL terminator one byte past the buffer
Record
CLSA-2026-1782981361
Updated
2026-11-02
OSVMGASA-2026-0265 No score

Updated rsync package fixes security vulnerabilities

The updated package fixes security vulnerabilities: Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write. (CVE-2026-29518) Rsync < 3.4.3 Authorization Bypass via Hostname Resolution. (CVE-2026-43617) Rsync < 3.4.3 Integer Overflow Information Disclosure. (CVE-2026-43618) Rsync < 3.4.3 Symlink Race Condition via Path-Based Syscalls. (CVE-2026-43619) Rsync < 3.4.3 Out-of-Bounds Array Read via recv_files(). (CVE-2026-43620) Rsync < 3.4.3 Off-by-One Stack Write via HTTP Proxy. (CVE-2026-45232)

Record
MGASA-2026-0265
Updated
2026-11-02
OSVopenSUSE-SU-2026:10857-1 No score

rsync-3.4.3-1.1 on GA media

These are all security issues fixed in the rsync-3.4.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10857-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20877-1 No score

Security update for rsync

This update for rsync fixes the following issues

  • CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).
  • CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).
  • CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
  • CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
  • CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
  • CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
  • CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
  • CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
Record
openSUSE-SU-2026:20877-1
Updated
2026-11-02
OSVSUSE-SU-2026:2038-1 No score

Security update for rsync

This update for rsync fixes the following issues

  • CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
  • CVE-2026-41035: Count of entries mismatch can lead to a use-after-free (bsc#1262223)
  • CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
  • CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
  • CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
  • CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
  • CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
Record
SUSE-SU-2026:2038-1
Updated
2026-11-02
OSVSUSE-SU-2026:2048-1 No score

Security update for rsync

This update for rsync fixes the following issues

  • CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
  • CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
  • CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
  • CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
  • CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
Record
SUSE-SU-2026:2048-1
Updated
2026-11-02
OSVSUSE-SU-2026:2083-1 No score

Security update for rsync

This update for rsync fixes the following issues

  • CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
  • CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
  • CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
  • CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
  • CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
  • CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
Record
SUSE-SU-2026:2083-1
Updated
2026-11-02
OSVSUSE-SU-2026:21726-1 No score

Security update for rsync

This update for rsync fixes the following issues

Security issues:

  • CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
  • CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
  • CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
  • CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
  • CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
  • CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).

Non security issues:

  • rsync --delay-updates never updates after interruption (bsc#1204538).
  • Fix duplication of flag causing illegal hashkey failures.
Record
SUSE-SU-2026:21726-1
Updated
2026-11-02
OSVSUSE-SU-2026:21739-1 No score

Security update for rsync

This update for rsync fixes the following issues

  • CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).
  • CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
  • CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
  • CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
  • CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
  • CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
Record
SUSE-SU-2026:21739-1
Updated
2026-11-02
OSVSUSE-SU-2026:21980-1 No score

Security update for rsync

This update for rsync fixes the following issues

  • CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).
  • CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).
  • CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
  • CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
  • CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
  • CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
  • CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
  • CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
Record
SUSE-SU-2026:21980-1
Updated
2026-11-02
OSVSUSE-SU-2026:22015-1 No score

Security update for rsync

This update for rsync fixes the following issues

  • CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).
  • CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).
  • CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
  • CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
  • CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
  • CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
  • CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
  • CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
Record
SUSE-SU-2026:22015-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rsync
Alpine:v3.20
 before 3.4.3-r0
3.4.3-r0
rsync
Alpine:v3.21
 before 3.4.3-r0
3.4.3-r0
rsync
Alpine:v3.22
 before 3.4.3-r0
3.4.3-r0
rsync
Alpine:v3.23
 before 3.4.3-r0
3.4.3-r0
rsync
Alpine:v3.24
 before 3.4.3-r0
3.4.3-r0
rsync
Azure Linux:3
 before 3.4.3-1
3.4.3-1
rsync
Alpaquita:23
 3.2.7-r0 up to 3.4.3-r0
3.4.3-r0
rsync
Alpaquita:25
 3.4.1-r0 up to 3.4.3-r0
3.4.3-r0
rsync
Alpaquita:stream
 3.2.5-r0 up to 3.4.3-r0
3.4.3-r0
rsync
TuxCare:AlmaLinux:9.6
 before 3.2.5-3.el9_6.tuxcare.els8
3.2.5-3.el9_6.tuxcare.els8
Show 26 moreShow less
Affected packages
PackageAffectedFixed
rsync-daemon
TuxCare:AlmaLinux:9.6
 before 3.2.5-3.el9_6.tuxcare.els8
3.2.5-3.el9_6.tuxcare.els8
rsync-rrsync
TuxCare:AlmaLinux:9.6
 before 3.2.5-3.el9_6.tuxcare.els8
3.2.5-3.el9_6.tuxcare.els8
rsync
TuxCare:AlmaLinux:9.2
 before 3.2.3-19.el9_2.tuxcare.els11
3.2.3-19.el9_2.tuxcare.els11
rsync-daemon
TuxCare:AlmaLinux:9.2
 before 3.2.3-19.el9_2.tuxcare.els11
3.2.3-19.el9_2.tuxcare.els11
rsync
Debian:12
 before 3.2.7-1+deb12u6, plus listed versions
3.2.7-13.2.7-1+deb12u13.2.7-1+deb12u23.2.7-1+deb12u33.2.7-1+deb12u43.2.7-1+deb12u5
3.2.7-1+deb12u6
rsync
Debian:13
 before 3.4.1+ds1-5+deb13u4, plus listed versions
3.4.1+ds1-53.4.1+ds1-5+deb13u13.4.1+ds1-5+deb13u23.4.1+ds1-5+deb13u3
3.4.1+ds1-5+deb13u4
rsync
Debian:14
 before 3.4.3+ds1-1, plus listed versions
3.4.1+ds1-53.4.1+ds1-63.4.1+ds1-73.4.1+ds1-8~exp13.4.2+ds1-13.4.2+ds1-2
3.4.3+ds1-1
rsync_jll
Julia
 before 3.4.4+0
3.4.4+0
rsync
Mageia:10
From an advisory covering 6 CVEs
 before 3.4.1-4.1.mga10
3.4.1-4.1.mga10
rsync
Mageia:9
From an advisory covering 6 CVEs
 before 3.2.7-1.5.mga9
3.2.7-1.5.mga9
rsync
openEuler:22.03-LTS-SP4
From an advisory covering 2 CVEs
 before 3.2.5-8.oe2203sp4
3.2.5-8.oe2203sp4
rsync
openEuler:24.03-LTS
From an advisory covering 2 CVEs
 before 3.2.7-10.oe2403
3.2.7-10.oe2403
rsync
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 3.2.7-10.oe2403sp1
3.2.7-10.oe2403sp1
rsync
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 3.2.7-10.oe2403sp3
3.2.7-10.oe2403sp3
rsync
openEuler:20.03-LTS-SP4
From an advisory covering 3 CVEs
 before 3.1.3-14.oe2003sp4
3.1.3-14.oe2003sp4
rsync
SUSE:Linux Enterprise Server 16.0
From an advisory covering 8 CVEs
 before 3.4.1-160000.4.1
3.4.1-160000.4.1
rsync
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 8 CVEs
 before 3.4.1-160000.4.1
3.4.1-160000.4.1
rsync
Ubuntu:Pro:14.04:LTS
 before 3.1.0-2ubuntu0.4+esm3, plus listed versions
3.0.9-4ubuntu13.1.0-23.1.0-2ubuntu0.13.1.0-2ubuntu0.23.1.0-2ubuntu0.33.1.0-2ubuntu0.43.1.0-2ubuntu0.4+esm13.1.0-2ubuntu0.4+esm2
3.1.0-2ubuntu0.4+esm3
rsync
Ubuntu:Pro:16.04:LTS
 before 3.1.1-3ubuntu1.3+esm5, plus listed versions
3.1.1-33.1.1-3ubuntu13.1.1-3ubuntu1.13.1.1-3ubuntu1.23.1.1-3ubuntu1.3
Show 4 moreShow less
3.1.1-3ubuntu1.3+esm13.1.1-3ubuntu1.3+esm23.1.1-3ubuntu1.3+esm33.1.1-3ubuntu1.3+esm4
3.1.1-3ubuntu1.3+esm5
rsync
Ubuntu:Pro:18.04:LTS
 before 3.1.2-2.1ubuntu1.6+esm3, plus listed versions
3.1.2-23.1.2-2.13.1.2-2.1ubuntu13.1.2-2.1ubuntu1.13.1.2-2.1ubuntu1.2
Show 6 moreShow less
3.1.2-2.1ubuntu1.33.1.2-2.1ubuntu1.43.1.2-2.1ubuntu1.53.1.2-2.1ubuntu1.63.1.2-2.1ubuntu1.6+esm13.1.2-2.1ubuntu1.6+esm2
3.1.2-2.1ubuntu1.6+esm3
rsync
Ubuntu:Pro:20.04:LTS
 before 3.1.3-8ubuntu0.9+esm1, plus listed versions
3.1.3-63.1.3-83.1.3-8ubuntu0.13.1.3-8ubuntu0.23.1.3-8ubuntu0.3
Show 5 moreShow less
3.1.3-8ubuntu0.43.1.3-8ubuntu0.53.1.3-8ubuntu0.73.1.3-8ubuntu0.83.1.3-8ubuntu0.9
3.1.3-8ubuntu0.9+esm1
rsync
Ubuntu:22.04:LTS
 before 3.2.7-0ubuntu0.22.04.6, plus listed versions
3.2.3-4ubuntu13.2.3-4ubuntu23.2.3-8ubuntu13.2.3-8ubuntu23.2.3-8ubuntu3
Show 4 moreShow less
3.2.3-8ubuntu3.13.2.7-0ubuntu0.22.04.23.2.7-0ubuntu0.22.04.33.2.7-0ubuntu0.22.04.4
3.2.7-0ubuntu0.22.04.6
rsync
Ubuntu:24.04:LTS
 before 3.2.7-1ubuntu1.4, plus listed versions
3.2.7-13.2.7-1build13.2.7-1build23.2.7-1ubuntu13.2.7-1ubuntu1.13.2.7-1ubuntu1.2
3.2.7-1ubuntu1.4
rsync
Ubuntu:25.10
 before 3.4.1+ds1-5ubuntu1.2, plus listed versions
3.4.1+ds1-33.4.1+ds1-43.4.1+ds1-53.4.1+ds1-5ubuntu1
3.4.1+ds1-5ubuntu1.2
rsync
Ubuntu:26.04:LTS
 before 3.4.1+ds1-7ubuntu0.2, plus listed versions
3.4.1+ds1-5ubuntu13.4.1+ds1-63.4.1+ds1-7
3.4.1+ds1-7ubuntu0.2
rsync
openSUSE:Tumbleweed
From an advisory covering 6 CVEs
 before 3.4.3-1.1
3.4.3-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-45232 is a low vulnerability (CVSS 2.1) in Rsyncproject Rsync, published May 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in rsync 3.4.3-r0.

References

Show 64 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open