A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade rsyslog-elasticsearchUpgrade rsyslog-debuginfoUpgrade rsyslog-crypto-debuginfoUpgrade rsyslog-openssl-debuginfoUpgrade rsyslog-debugsourceUpgrade rsyslog-mmtaghostnameUpgrade rsyslog-logrotateUpgrade rsyslog-mmkubernetesUpgrade rsyslog-mmtaghostname-debuginfoUpgrade rsyslog-mmkubernetes-debuginfoUpgrade rsyslog-docUpgrade rsyslog-mmaudit-debuginfoUpgrade rsyslog-mmfields-debuginfoUpgrade rsyslog-mmfieldsUpgrade rsyslog-mmnormalizeUpgrade rsyslog-mmauditUpgrade rsyslog-mmnormalize-debuginfoUpgrade rsyslog-opensslUpgrade rsyslog-elasticsearch-debuginfoUpgrade rsyslog-mmjsonparseUpgrade rsyslog-cryptoUpgrade rsyslog-mmjsonparse-debuginfoUpgrade rsyslog | Sep 1, 2026 | Aug 12, 2026 |
| Debian | — | Upgrade rsyslog | Sep 21, 2026 | Aug 12, 2026 |
| Redhat_linux | — | Upgrade rsyslogUpgrade rsyslog-opensslUpgrade rsyslog-docUpgrade rsyslog-omamqp1Upgrade rsyslog-udpspoof-debuginfoUpgrade rsyslog-gssapiUpgrade rsyslog-elasticsearchUpgrade rsyslog-kafkaUpgrade rsyslog-omamqp1-debuginfoUpgrade rsyslog-mmfieldsUpgrade rsyslog-mmnormalize-debuginfoUpgrade rsyslog-elasticsearch-debuginfoUpgrade rsyslog-mmsnmptrapdUpgrade rsyslog-pgsqlUpgrade rsyslog-mmaudit-debuginfoUpgrade rsyslog-cryptoUpgrade rsyslog-mmjsonparse-debuginfoUpgrade rsyslog-logrotateUpgrade rsyslog-snmp-debuginfoUpgrade rsyslog-openssl-debuginfoUpgrade rsyslog-mmnormalizeUpgrade rsyslog-mysql-debuginfoUpgrade rsyslog-mmauditUpgrade rsyslog-mmsnmptrapd-debuginfoUpgrade rsyslog-mmkubernetesUpgrade rsyslog-gnutlsUpgrade rsyslog-debuginfoNo solution existsUpgrade rsyslog-mmkubernetes-debuginfoUpgrade rsyslog-crypto-debuginfoUpgrade rsyslog-kafka-debuginfoUpgrade rsyslog-relp-debuginfoUpgrade rsyslog-udpspoofUpgrade rsyslog-mmfields-debuginfoUpgrade rsyslog-snmpUpgrade rsyslog-pgsql-debuginfoUpgrade rsyslog-mmjsonparseUpgrade rsyslog-gnutls-debuginfoUpgrade rsyslog-debugsourceUpgrade rsyslog-gssapi-debuginfoUpgrade rsyslog-mysqlUpgrade rsyslog-relp | Aug 17, 2026 | Jul 22, 2026 |
| Rocky_linux | — | Upgrade rsyslog-relpUpgrade rsyslog-mysql-debuginfoUpgrade rsyslog-openssl-debuginfoUpgrade rsyslog-snmp-debuginfoUpgrade rsyslog-pgsql-debuginfoUpgrade rsyslog-mmkubernetesUpgrade rsyslog-crypto-debuginfoUpgrade rsyslog-logrotateUpgrade rsyslog-mmfields-debuginfoUpgrade rsyslog-mysqlUpgrade rsyslog-mmnormalizeUpgrade rsyslog-mmnormalize-debuginfoUpgrade rsyslog-omamqp1Upgrade rsyslog-mmsnmptrapd-debuginfoUpgrade rsyslog-elasticsearchUpgrade rsyslog-mmauditUpgrade rsyslog-mmkubernetes-debuginfoUpgrade rsyslog-udpspoofUpgrade rsyslog-pgsqlUpgrade rsyslog-opensslUpgrade rsyslog-gssapiUpgrade rsyslog-gnutlsUpgrade rsyslog-mmaudit-debuginfoUpgrade rsyslog-kafka-debuginfoUpgrade rsyslog-cryptoUpgrade rsyslog-mmsnmptrapdUpgrade rsyslog-mmjsonparseUpgrade rsyslog-udpspoof-debuginfoUpgrade rsyslog-kafkaUpgrade rsyslogUpgrade rsyslog-gssapi-debuginfoUpgrade rsyslog-mmfieldsUpgrade rsyslog-mmjsonparse-debuginfoUpgrade rsyslog-debugsourceUpgrade rsyslog-relp-debuginfoUpgrade rsyslog-omamqp1-debuginfoUpgrade rsyslog-snmpUpgrade rsyslog-gnutls-debuginfoUpgrade rsyslog-elasticsearch-debuginfoUpgrade rsyslog-debuginfo | Sep 18, 2026 | Sep 16, 2026 |
| Ubuntu | — | Upgrade rsyslog | Aug 18, 2026 | Aug 13, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub