A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade rsyslog-mmkubernetesUpgrade rsyslog-openssl-debuginfoUpgrade rsyslog-elasticsearchUpgrade rsyslog-crypto-debuginfoUpgrade rsyslog-mmaudit-debuginfoUpgrade rsyslog-mmfields-debuginfoUpgrade rsyslog-debuginfoUpgrade rsyslog-mmtaghostnameUpgrade rsyslog-logrotateUpgrade rsyslog-mmkubernetes-debuginfoUpgrade rsyslog-mmtaghostname-debuginfoUpgrade rsyslog-debugsourceUpgrade rsyslog-docUpgrade rsyslog-mmjsonparseUpgrade rsyslog-opensslUpgrade rsyslog-mmfieldsUpgrade rsyslog-mmauditUpgrade rsyslog-mmnormalizeUpgrade rsyslog-mmjsonparse-debuginfoUpgrade rsyslogUpgrade rsyslog-mmnormalize-debuginfoUpgrade rsyslog-cryptoUpgrade rsyslog-elasticsearch-debuginfo | Sep 1, 2026 | Aug 12, 2026 |
| Debian | — | Upgrade rsyslog | Sep 21, 2026 | Aug 12, 2026 |
| Redhat_linux | — | Upgrade rsyslog-mmjsonparse-debuginfoUpgrade rsyslog-omamqp1Upgrade rsyslog-gssapiUpgrade rsyslog-elasticsearch-debuginfoUpgrade rsyslog-udpspoof-debuginfoUpgrade rsyslog-docUpgrade rsyslog-mmaudit-debuginfoUpgrade rsyslog-omamqp1-debuginfoUpgrade rsyslog-mmfieldsUpgrade rsyslog-mmsnmptrapdUpgrade rsyslog-pgsqlUpgrade rsyslog-elasticsearchUpgrade rsyslog-kafkaUpgrade rsyslog-mmnormalize-debuginfoUpgrade rsyslog-opensslUpgrade rsyslogUpgrade rsyslog-cryptoUpgrade rsyslog-openssl-debuginfoUpgrade rsyslog-pgsql-debuginfoUpgrade rsyslog-mysqlUpgrade rsyslog-mmkubernetes-debuginfoUpgrade rsyslog-crypto-debuginfoUpgrade rsyslog-debugsourceNo solution existsUpgrade rsyslog-gssapi-debuginfoUpgrade rsyslog-logrotateUpgrade rsyslog-mmfields-debuginfoUpgrade rsyslog-relpUpgrade rsyslog-mmnormalizeUpgrade rsyslog-gnutlsUpgrade rsyslog-relp-debuginfoUpgrade rsyslog-mmauditUpgrade rsyslog-gnutls-debuginfoUpgrade rsyslog-snmp-debuginfoUpgrade rsyslog-mysql-debuginfoUpgrade rsyslog-mmsnmptrapd-debuginfoUpgrade rsyslog-mmjsonparseUpgrade rsyslog-debuginfoUpgrade rsyslog-udpspoofUpgrade rsyslog-snmpUpgrade rsyslog-mmkubernetesUpgrade rsyslog-kafka-debuginfo | Aug 17, 2026 | Jul 22, 2026 |
| Rocky_linux | — | Upgrade rsyslog-debuginfoUpgrade rsyslog-snmpUpgrade rsyslog-cryptoUpgrade rsyslog-udpspoof-debuginfoUpgrade rsyslog-relp-debuginfoUpgrade rsyslog-debugsourceUpgrade rsyslogUpgrade rsyslog-gssapi-debuginfoUpgrade rsyslog-mmjsonparse-debuginfoUpgrade rsyslog-mmjsonparseUpgrade rsyslog-mmaudit-debuginfoUpgrade rsyslog-mmfieldsUpgrade rsyslog-mmsnmptrapdUpgrade rsyslog-gnutls-debuginfoUpgrade rsyslog-omamqp1-debuginfoUpgrade rsyslog-elasticsearch-debuginfoUpgrade rsyslog-kafkaUpgrade rsyslog-kafka-debuginfoUpgrade rsyslog-mmnormalize-debuginfoUpgrade rsyslog-mysql-debuginfoUpgrade rsyslog-pgsqlUpgrade rsyslog-pgsql-debuginfoUpgrade rsyslog-mmauditUpgrade rsyslog-udpspoofUpgrade rsyslog-gnutlsUpgrade rsyslog-mmkubernetes-debuginfoUpgrade rsyslog-omamqp1Upgrade rsyslog-opensslUpgrade rsyslog-mmfields-debuginfoUpgrade rsyslog-logrotateUpgrade rsyslog-gssapiUpgrade rsyslog-elasticsearchUpgrade rsyslog-snmp-debuginfoUpgrade rsyslog-mmnormalizeUpgrade rsyslog-mmsnmptrapd-debuginfoUpgrade rsyslog-crypto-debuginfoUpgrade rsyslog-relpUpgrade rsyslog-mysqlUpgrade rsyslog-mmkubernetesUpgrade rsyslog-openssl-debuginfo | Sep 18, 2026 | Sep 16, 2026 |
| Ubuntu | — | Upgrade rsyslog | Aug 18, 2026 | Aug 13, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub