AZL-86997
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-86997.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-86997
- Upstream
- Published
- 2026-05-20T02:16:36Z
- Modified
- 2026-08-28T17:48:00.270288851Z
- Summary
- CVE-2026-45232 affecting package rsync for versions less than 3.4.3-1
- Details
-
Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establishproxyconnection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.
- References