rsync EUVD-2026-31009

Two concurrent non-default conditions must hold for exploitation: (1) the RSYNC_PROXY environment variable must be explicitly set on the target system, directing rsync to route connections through an HTTP CONNECT proxy - this is not a default rsync configuration; and (2) the attacker must either control the proxy server specified by that variable or hold a MitM network position between the rsync client and the proxy host. User interaction is additionally required (UI:R per CVSS vector), as a user must actively initiate an rsync session through the proxy. Exploitation is bounded to a low-severity availability impact (process crash); no confidentiality or integrity impact is possible per the CVSS vector. Default rsync deployments that do not configure RSYNC_PROXY are entirely unexposed to this vulnerability.

The CVSS 3.1 score of 3.1 (Low) accurately reflects the constrained real-world risk. The vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L indicates network reachability but High complexity (AC:H), meaning exploitation requires either a MitM network position or control of the proxy server - both non-trivial preconditions. User interaction (UI:R) further constrains exploitation to sessions actively initiated by a user. The impact is limited to Availability:Low, with zero confidentiality or integrity consequence. No EPSS score was supplied in the input data, so probabilistic exploitation likelihood cannot be quantified. No KEV listing and no public exploit code exist at time of analysis, reinforcing that this is a low-priority finding for most organizations. The single null-byte overwrite primitive is unlikely to enable reliable code execution; crash-based denial of service is the realistic worst case. The CVSS vector is fully consistent with the description - no conflicting signals detected.

An attacker who controls the HTTP proxy server referenced by RSYNC_PROXY - or who has achieved a MitM position on the network path between the rsync client and that proxy - waits for a user to initiate an rsync session. The attacker responds to the HTTP CONNECT request with a status line of 1023 or more bytes containing no newline terminator. When establish_proxy_connection() processes this response, a null byte is written one position past the end of the 1024-byte stack buffer, corrupting adjacent stack data and crashing the rsync process. No public exploit code has been identified at time of analysis.