{"id":"CVE-2026-45232","aliases":["ALPINE-CVE-2026-45232","AZL-86997","BELL-CVE-2026-45232","CLSA-2026-1780922909","CLSA-2026-1782981361","DEBIAN-CVE-2026-45232","EUVD-2026-31009","GHSA-8f85-j2cv-59m8","JLSEC-2026-632","MGASA-2026-0265","OESA-2026-2502","OESA-2026-2503","OESA-2026-2504","OESA-2026-2505","OESA-2026-2550","SUSE-SU-2026:2038-1","SUSE-SU-2026:2048-1","SUSE-SU-2026:2083-1","SUSE-SU-2026:21726-1","SUSE-SU-2026:21739-1","SUSE-SU-2026:21980-1","SUSE-SU-2026:22015-1","UBUNTU-CVE-2026-45232","openSUSE-SU-2026:10857-1","openSUSE-SU-2026:20877-1"],"status":"published","title":"Rsync \u003c 3.4.3 Off-by-One Stack Write via HTTP Proxy","description":"Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.","severity":{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00337,"percentile":0.27344,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-193"],"published":"2026-05-20T00:00:00Z","modified":"2026-10-28T02:31:14Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"rsync","fixed_in":["3.4.3-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"rsync","fixed_in":["3.4.3-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync","fixed_in":["3.2.5-3.el9_6.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync-daemon","fixed_in":["3.2.5-3.el9_6.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync-rrsync","fixed_in":["3.2.5-3.el9_6.tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"rsync","fixed_in":["3.2.3-19.el9_2.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"rsync-daemon","fixed_in":["3.2.3-19.el9_2.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"rsync","fixed_in":["3.2.7-1+deb12u6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rsync","fixed_in":["3.4.1+ds1-5+deb13u4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rsync","fixed_in":["3.4.3+ds1-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"rsync_jll","fixed_in":["3.4.4+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"rsync","fixed_in":["3.1.0-2ubuntu0.4+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rsync","fixed_in":["3.1.1-3ubuntu1.3+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rsync","fixed_in":["3.1.2-2.1ubuntu1.6+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rsync","fixed_in":["3.1.3-8ubuntu0.9+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rsync","fixed_in":["3.2.7-0ubuntu0.22.04.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rsync","fixed_in":["3.2.7-1ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"rsync","fixed_in":["3.4.1+ds1-5ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"rsync","fixed_in":["3.4.1+ds1-7ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.7-r0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.1-r0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.5-r0"},{"fixed":"3.4.3-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-3.el9_6.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-3.el9_6.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-3.el9_6.tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-19.el9_2.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-19.el9_2.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1+deb12u6"}]}],"versions":["3.2.7-1","3.2.7-1+deb12u1","3.2.7-1+deb12u2","3.2.7-1+deb12u3","3.2.7-1+deb12u4","3.2.7-1+deb12u5"]},{"source":"osv","ecosystem":"Debian:13","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+ds1-5+deb13u4"}]}],"versions":["3.4.1+ds1-5","3.4.1+ds1-5+deb13u1","3.4.1+ds1-5+deb13u2","3.4.1+ds1-5+deb13u3"]},{"source":"osv","ecosystem":"Debian:14","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3+ds1-1"}]}],"versions":["3.4.1+ds1-5","3.4.1+ds1-6","3.4.1+ds1-7","3.4.1+ds1-8~exp1","3.4.2+ds1-1","3.4.2+ds1-2"]},{"source":"osv","ecosystem":"Julia","package":"rsync_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.4.4+0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-4.1.mga10"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:9","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1.5.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-8.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-10.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-10.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-10.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-14.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-160000.4.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-160000.4.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-2ubuntu0.4+esm3"}]}],"versions":["3.0.9-4ubuntu1","3.1.0-2","3.1.0-2ubuntu0.1","3.1.0-2ubuntu0.2","3.1.0-2ubuntu0.3","3.1.0-2ubuntu0.4","3.1.0-2ubuntu0.4+esm1","3.1.0-2ubuntu0.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3ubuntu1.3+esm5"}]}],"versions":["3.1.1-3","3.1.1-3ubuntu1","3.1.1-3ubuntu1.1","3.1.1-3ubuntu1.2","3.1.1-3ubuntu1.3","3.1.1-3ubuntu1.3+esm1","3.1.1-3ubuntu1.3+esm2","3.1.1-3ubuntu1.3+esm3","3.1.1-3ubuntu1.3+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2.1ubuntu1.6+esm3"}]}],"versions":["3.1.2-2","3.1.2-2.1","3.1.2-2.1ubuntu1","3.1.2-2.1ubuntu1.1","3.1.2-2.1ubuntu1.2","3.1.2-2.1ubuntu1.3","3.1.2-2.1ubuntu1.4","3.1.2-2.1ubuntu1.5","3.1.2-2.1ubuntu1.6","3.1.2-2.1ubuntu1.6+esm1","3.1.2-2.1ubuntu1.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-8ubuntu0.9+esm1"}]}],"versions":["3.1.3-6","3.1.3-8","3.1.3-8ubuntu0.1","3.1.3-8ubuntu0.2","3.1.3-8ubuntu0.3","3.1.3-8ubuntu0.4","3.1.3-8ubuntu0.5","3.1.3-8ubuntu0.7","3.1.3-8ubuntu0.8","3.1.3-8ubuntu0.9"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-0ubuntu0.22.04.6"}]}],"versions":["3.2.3-4ubuntu1","3.2.3-4ubuntu2","3.2.3-8ubuntu1","3.2.3-8ubuntu2","3.2.3-8ubuntu3","3.2.3-8ubuntu3.1","3.2.7-0ubuntu0.22.04.2","3.2.7-0ubuntu0.22.04.3","3.2.7-0ubuntu0.22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1ubuntu1.4"}]}],"versions":["3.2.7-1","3.2.7-1build1","3.2.7-1build2","3.2.7-1ubuntu1","3.2.7-1ubuntu1.1","3.2.7-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+ds1-5ubuntu1.2"}]}],"versions":["3.4.1+ds1-3","3.4.1+ds1-4","3.4.1+ds1-5","3.4.1+ds1-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+ds1-7ubuntu0.2"}]}],"versions":["3.4.1+ds1-5ubuntu1","3.4.1+ds1-6","3.4.1+ds1-7"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-1.1"}]}],"bundled":6}],"products":[{"vendor":"rsyncproject","product":"rsync"},{"vendor":"samba","product":"rsync"}],"references":[{"url":"https://github.com/RsyncProject/rsync/security/advisories/GHSA-8f85-j2cv-59m8","tags":["vendor-advisory","Vendor Advisory","advisory","web"]},{"url":"https://github.com/RsyncProject/rsync/releases/tag/v3.4.3","tags":["release-notes","Release Notes","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/rsync-off-by-one-stack-write-via-http-proxy","tags":["third-party-advisory","Third Party Advisory","advisory","web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-45232","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45232","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-45232","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1780922909.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1782981361.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45232.json","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-45232","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0265.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35562","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/20/6","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00193.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/FBOANNVT2JXHE24DJ2WIYE2BNCWRGT24/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/4RPOIF6TVE233FKZN5TAC6XTNQ5WVFYL/","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/08/1","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8349-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8349-2","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2502","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43618","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2503","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2504","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2505","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2550","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43620","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262038-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234100","tags":["report"]},{"url":"https://bugzilla.suse.com/1234101","tags":["report"]},{"url":"https://bugzilla.suse.com/1234102","tags":["report"]},{"url":"https://bugzilla.suse.com/1234103","tags":["report"]},{"url":"https://bugzilla.suse.com/1234104","tags":["report"]},{"url":"https://bugzilla.suse.com/1235475","tags":["report"]},{"url":"https://bugzilla.suse.com/1254441","tags":["report"]},{"url":"https://bugzilla.suse.com/1262223","tags":["report"]},{"url":"https://bugzilla.suse.com/1264511","tags":["report"]},{"url":"https://bugzilla.suse.com/1264512","tags":["report"]},{"url":"https://bugzilla.suse.com/1264513","tags":["report"]},{"url":"https://bugzilla.suse.com/1264514","tags":["report"]},{"url":"https://bugzilla.suse.com/1264515","tags":["report"]},{"url":"https://bugzilla.suse.com/1265296","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45232","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262048-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262083-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621726-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201840","tags":["report"]},{"url":"https://bugzilla.suse.com/1202970","tags":["report"]},{"url":"https://bugzilla.suse.com/1204538","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29154","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621739-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621980-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622015-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-45232","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45232","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8283-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8349-3","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-45232","title":"Rsync \u003c 3.4.3 Off-by-One Stack Write via HTTP Proxy","description":"Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.","status":"published","published":"2026-05-20T00:45:28.54Z","modified":"2026-11-08T14:03:45.995Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low","assessor":"cna"},{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-193"],"updated_at":"2026-11-08T15:43:33.322657Z"}],"euvd":[{"id":"EUVD-2026-31009","description":"Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.","status":"published","published":"2026-05-20T00:45:28Z","modified":"2026-11-08T14:03:45Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-08T15:13:08.77824Z"}],"nvd":[{"id":"CVE-2026-45232","description":"Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.","status":"published","published":"2026-05-20T02:16:36.887Z","modified":"2026-07-24T09:10:00.153Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"primary"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T14:12:19.752984Z"}],"osv":[{"id":"ALPINE-CVE-2026-45232","description":"Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.","status":"published","published":"2026-05-20T02:16:36.887Z","modified":"2026-10-01T02:17:49.31164786Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-45232","status":"published","published":"2026-05-21T06:10:54.663269Z","modified":"2026-05-26T07:15:13.905456141Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:28:24.12174Z"},{"id":"CVE-2026-45232","title":"Rsync \u003c 3.4.3 Off-by-One Stack Write via HTTP Proxy","description":"Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.","status":"published","published":"2026-05-20T00:45:28.54Z","modified":"2026-11-09T02:30:25.221838619Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-193"],"updated_at":"2026-11-09T03:16:44.651171Z"},{"id":"DEBIAN-CVE-2026-45232","description":"Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.","status":"published","published":"2026-05-20T02:16:36.887Z","modified":"2026-10-01T03:03:05.899790384Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"JLSEC-2026-632","description":"Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the `establish_proxy_connection()` function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the `RSYNC_PROXY` environment variable is set.","status":"published","published":"2026-06-25T17:41:14.392Z","modified":"2026-07-25T18:23:57.980220388Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"},{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2026-2502","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026amp;quot;rsync algorithm\u0026amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\n\nRsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.(CVE-2026-43618)\n\nRsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.(CVE-2026-45232)","status":"published","published":"2026-05-29T11:11:27Z","modified":"2026-08-18T01:20:01.337509007Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2503","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026amp;quot;rsync algorithm\u0026amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\n\nRsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.(CVE-2026-43618)\n\nRsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.(CVE-2026-45232)","status":"published","published":"2026-05-29T11:11:27Z","modified":"2026-08-18T01:20:01.472470437Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2504","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026amp;quot;rsync algorithm\u0026amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\n\nRsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.(CVE-2026-43618)\n\nRsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.(CVE-2026-45232)","status":"published","published":"2026-05-29T11:11:27Z","modified":"2026-08-18T01:20:01.517490681Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2505","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026amp;quot;rsync algorithm\u0026amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\n\nRsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.(CVE-2026-43618)\n\nRsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.(CVE-2026-45232)","status":"published","published":"2026-05-29T11:11:27Z","modified":"2026-08-18T01:20:01.4127594Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2550","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026amp;quot;rsync algorithm\u0026amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\n\nRsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.(CVE-2026-43618)\n\nRsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client.(CVE-2026-43620)\n\nRsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.(CVE-2026-45232)","status":"published","published":"2026-06-05T11:11:29Z","modified":"2026-08-18T01:20:02.525927506Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"UBUNTU-CVE-2026-45232","description":"Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.","status":"published","published":"2026-05-20T00:00:00Z","modified":"2026-06-16T13:44:21.289634719Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"},{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T16:56:26.396868Z"},{"id":"AZL-86997","title":"CVE-2026-45232 affecting package rsync for versions less than 3.4.3-1","description":"Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.","status":"published","published":"2026-05-20T02:16:36Z","modified":"2026-08-28T17:56:23.328599Z","updated_at":"2026-11-02T15:28:10.677811Z"},{"id":"CLSA-2026-1780922909","title":"rsync: Fix of CVE-2026-45232","description":"- CVE-2026-45232: fix off-by-one out-of-bounds stack write in\n  establish_proxy_connection() by rejecting an over-long HTTP proxy\n  response line","status":"published","published":"2026-06-08T18:39:14Z","modified":"2026-10-26T09:31:06.745022857Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1782981361","title":"rsync: Fix of CVE-2026-45232","description":"- CVE-2026-45232: fix off-by-one out-of-bounds stack write in\n  establish_proxy_connection() when a malicious HTTP proxy returns an\n  over-long response line without a newline; reject the buffer-full\n  case instead of writing the NUL terminator one byte past the buffer","status":"published","published":"2026-07-02T08:36:15Z","modified":"2026-10-26T09:30:24.040932896Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"MGASA-2026-0265","title":"Updated rsync package fixes security vulnerabilities","description":"The updated package fixes security vulnerabilities:\nRsync \u003c 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File\nWrite. (CVE-2026-29518)\nRsync \u003c 3.4.3 Authorization Bypass via Hostname Resolution.\n(CVE-2026-43617)\nRsync \u003c 3.4.3 Integer Overflow Information Disclosure. (CVE-2026-43618)\nRsync \u003c 3.4.3 Symlink Race Condition via Path-Based Syscalls.\n(CVE-2026-43619)\nRsync \u003c 3.4.3 Out-of-Bounds Array Read via recv_files().\n(CVE-2026-43620)\nRsync \u003c 3.4.3 Off-by-One Stack Write via HTTP Proxy. (CVE-2026-45232)\n","status":"published","published":"2026-07-18T23:55:48Z","modified":"2026-07-19T00:00:04.314738521Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:10857-1","title":"rsync-3.4.3-1.1 on GA media","description":"These are all security issues fixed in the rsync-3.4.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-24T00:00:00Z","modified":"2026-05-25T07:45:05.511446534Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:20877-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-06-02T09:13:41Z","modified":"2026-06-04T09:00:10.423530016Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:2038-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n    \n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-41035: Count of entries mismatch can lead to a use-after-free (bsc#1262223)\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-05-21T13:33:41Z","modified":"2026-05-22T09:00:05.164069318Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:2048-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-05-25T13:55:42Z","modified":"2026-05-26T08:15:05.350251039Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:2083-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-05-27T07:56:11Z","modified":"2026-05-28T08:15:05.799079873Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:21726-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\nSecurity issues:\n\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n\nNon security issues:\n\n- rsync --delay-updates never updates after interruption (bsc#1204538).\n- Fix duplication of flag causing illegal hashkey failures.\n","status":"published","published":"2026-05-21T11:04:19Z","modified":"2026-05-23T18:23:40.42363199Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21739-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-05-21T11:23:33Z","modified":"2026-05-23T18:23:41.730720723Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21980-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-06-02T09:14:50Z","modified":"2026-06-04T09:00:07.395663315Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22015-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-06-02T09:14:50Z","modified":"2026-06-09T18:24:27.804925101Z","updated_at":"2026-11-02T15:54:02.654057Z"}]}}