{
  "cve": "CVE-2026-45232",
  "validation_status": "success",
  "vulnerability_confirmed": true,
  "fix_verified": true,
  "reproduction_method": "rsync compiled with AddressSanitizer, triggered via RSYNC_PROXY with a mock TCP proxy that sends 1023 bytes without a newline",
  "vulnerable_version": "3.4.2",
  "fixed_version": "3.4.3",
  "vulnerable_binary": "rsync",
  "affected_function": "establish_proxy_connection() in socket.c",
  "vulnerable_run": {
    "exit_status": 1,
    "asan_detected": true,
    "sanitizer_type": "AddressSanitizer",
    "error_type": "stack-buffer-overflow",
    "overflow_location": "socket.c:95 in establish_proxy_connection",
    "overflow_target": "buffer (line 55) 1024-byte stack buffer",
    "log_file": "logs/rsync_v3.4.2_proxy.log"
  },
  "fixed_run": {
    "exit_status": 1,
    "asan_detected": false,
    "behavior": "graceful rejection with error message 'proxy response line too long'",
    "log_file": "logs/rsync_v3.4.3_proxy.log"
  },
  "conclusion": "CVE-2026-45232 is a real off-by-one stack-buffer-overflow in rsync's establish_proxy_connection(). The vulnerability is reproducible in v3.4.2 and is correctly fixed in v3.4.3, which now rejects overlong proxy response lines instead of writing one byte past the 1024-byte stack buffer.",
  "timestamp": "2025-01-01T00:00:00Z"
}