{
  "ticket_id": "CVE-2026-45232",
  "code_root": "external/rsync",
  "source": {
    "type": "cve",
    "cve_id": "CVE-2026-45232",
    "advisory_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45232",
    "vendor": "RsyncProject",
    "product": "rsync",
    "repo": "https://github.com/RsyncProject/rsync"
  },
  "facts": {
    "cve_id": "CVE-2026-45232",
    "issue_summary": "Off-by-one out-of-bounds stack write in rsync. The function establish_proxy_connection() in socket.c writes one byte past the end of a stack buffer when handling a proxy server's CONNECT response. A malicious proxy server that returns an overlong CONNECT response corrupts adjacent stack memory.",
    "vulnerability_type": "Off-by-one Out-of-Bounds Stack Write",
    "suspected_cwe": ["CWE-193", "CWE-787"],
    "affected_versions": "< 3.4.3",
    "fixed_versions": ["3.4.3"],
    "reproduce_version": "3.4.2",
    "verify_fixed_version": "3.4.3",
    "repo_url": "https://github.com/RsyncProject/rsync.git",
    "repo_url_alt": "https://git.samba.org/rsync.git",
    "code_root": "external/rsync",
    "language": "C",
    "package": "rsync",
    "vulnerable_function": "establish_proxy_connection() in socket.c",
    "attacker_access": "A malicious or attacker-controlled HTTP proxy that the rsync client is configured to connect through (e.g. via RSYNC_PROXY).",
    "exploit_outline": "Build rsync 3.4.2. Configure the rsync client to connect through a proxy under attacker control. Have that proxy return an overlong CONNECT response. establish_proxy_connection() in socket.c writes one byte past the end of a stack buffer while parsing the response, corrupting adjacent stack memory.",
    "vulnerable_indicator": "On rsync 3.4.2 built with -fstack-protector and/or AddressSanitizer, a proxied connection where the proxy returns an overlong CONNECT response triggers a stack-smashing abort or an ASan stack-buffer-overflow error and rsync exits non-zero.",
    "fixed_indicator": "On rsync 3.4.3, the same proxied connection with the same overlong CONNECT response does NOT trigger a stack-smashing abort or ASan error; the off-by-one write no longer occurs.",
    "reproduction_requirements": "A C toolchain to build rsync 3.4.2 and 3.4.3, ideally with -fstack-protector-strong and/or AddressSanitizer to make the one-byte overflow observable. A minimal mock HTTP proxy (e.g. a small local listener) that returns an overlong CONNECT response, and an rsync invocation configured to use that proxy. No remote rsync server with real data is required - only the proxy handshake path is exercised.",
    "notes": "The fix commit is not pinned in the advisory data provided - the Pruva repro agent should locate it in the 3.4.2 -> 3.4.3 history of socket.c. NVD rates this LOW per its own analysis. The off-by-one is a single-byte write, so building with -fstack-protector / ASan is important to make it reliably observable as a non-zero exit / detector error rather than silent corruption."
  }
}