PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45232 Samba CVE debrief

CVE-2026-45232 affects Rsync versions before 3.4.3 and is a low-severity memory corruption flaw in HTTP proxy handling. The issue is an off-by-one out-of-bounds stack write in establish_proxy_connection() in socket.c, triggered when a malformed proxy response line of 1023 or more bytes is sent without a newline terminator. The vulnerability can be reached over the network, but it requires user interaction in the form of RSYNC_PROXY being set and a proxy path the attacker can influence or intercept.

Vendor
Samba
Product
Rsync
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-20
Original CVE updated
2026-07-24
Advisory published
2026-05-20
Advisory updated
2026-07-24

Who should care

Administrators and developers who use Rsync with the RSYNC_PROXY environment variable enabled, especially in environments where proxy traffic may be controlled, intercepted, or otherwise influenced by an attacker. Security teams should also care about systems pinned to Rsync releases earlier than 3.4.3.

Technical summary

NVD describes the weakness as CWE-193 (off-by-one error). In affected versions, a malformed HTTP proxy response can cause a null byte to be written one byte past the intended stack buffer boundary in establish_proxy_connection(). The CVSS v4.0 vector reflects network reachability, high attack complexity, and required user interaction, with low availability impact and no identified confidentiality or integrity impact in the record.

Defensive priority

Low to moderate. The CVSS score is low, but the flaw is memory-corruption related and is reachable over the network when proxy conditions are met. Prioritize remediation on exposed or proxy-dependent Rsync deployments, then confirm all installations are at 3.4.3 or later.

Recommended defensive actions

  • Upgrade Rsync to version 3.4.3 or later.
  • Review whether RSYNC_PROXY is used in production or privileged automation contexts.
  • If proxy use is required, restrict which proxy endpoints can be reached and reduce the chance of attacker-controlled proxy responses.
  • Inventory hosts running affected Rsync versions and verify package manager or vendor backports where applicable.
  • Monitor vendor and release-note guidance for any additional hardening or backported fixes.

Evidence notes

The CVE record and NVD entry identify Rsync before 3.4.3 as vulnerable and describe an off-by-one out-of-bounds stack write in establish_proxy_connection() in socket.c. The supplied description states the trigger is a malformed HTTP proxy response line of 1023 or more bytes without a newline terminator, and that exploitation depends on RSYNC_PROXY being set. The NVD metadata classifies the weakness as CWE-193 and shows CVSS 4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L. Release notes and vendor advisory links are provided as mitigation references for the 3.4.3 fix.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45232 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45232

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45232 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45232

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.