Description
Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This can result in a segfault or some other malfunction. As of our understanding, this vulnerability can not be used for remote code execution. But there may still be a slight chance for experts to do that. The bug occurs when the octet count is read. While there is a check for the maximum number of octets, digits are written to a heap buffer even when the octet count is over the maximum, This can be used to overrun the memory buffer. However, once the sequence of digits stop, no additional characters can be added to the buffer. In our opinion, this makes remote exploits impossible or at least highly complex. Octet-counted framing is one of two potential framing modes. It is relatively uncommon, but enabled by default on receivers. Modules `imtcp`, `imptcp`, `imgssapi`, and `imhttp` are used for regular syslog message reception. It is best practice not to directly expose them to the public. When this practice is followed, the risk is considerably lower. Module `imdiag` is a diagnostics module primarily intended for testbench runs. We do not expect it to be present on any production installation. Octet-counted framing is not very common. Usually, it needs to be specifically enabled at senders. If users do not need it, they can turn it off for the most important modules. This will mitigate the vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rsyslog | rsyslog | < 8.2204.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rsyslog | 8.2204.1-1 | — |
| Debian 13 | rsyslog | 8.2204.1-1 | — |
| Debian 12 | rsyslog | 8.2204.1-1 | — |
| Debian 11 | rsyslog | 8.2102.0-2+deb11u1 | DSA-5150-1 |
| Debian 10 | rsyslog | 8.1901.0-1+deb10u2 | DSA-5150-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | rsyslog | 8.24.0-1+deb9u2 | DLA-3016-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | rsyslog | 8.2112.0-2ubuntu2.2 | USN-5404-1 |
| Ubuntu 20.04 LTS | rsyslog | 8.2001.0-1ubuntu1.3 | USN-5404-1 |
| Ubuntu 18.04 LTS | rsyslog | 8.32.0-1ubuntu4.2 | USN-5404-1 |
| Ubuntu 14.04 LTS | rsyslog | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | rsyslog | 8.16.0-1ubuntu3.1+esm2 | USN-5404-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | rsyslog +20 | 8.2102.0-101.el9_0.1 | RHSA-2022:4795 |
| RHEL 8 | rsyslog +19 | 8.2102.0-7.el8_6.1 | RHSA-2022:4799 |
| RHEL 7 | redhat-virtualization-host +1 | 4.3.23-20220622.0.el7_9 | RHSA-2022:5439 |
| RHEL 7 | rsyslog +17 | 8.24.0-57.el7_9.3 | RHSA-2022:4803 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | rsyslog-mmnormalize +1 | 8.24.0-57.el7_9.3 | RHSA-2022:4803 |
| Red Hat Rhev Hypervisor 4 | redhat-virtualization-host +1 | 4.5.0-202205291010_8.6 | RHSA-2022:4896 |
| RHEL 8.4 EUS | rsyslog +17 | 8.1911.0-7.el8_4.3 | RHSA-2022:4802 |
| RHEL 8.2 EUS | rsyslog +15 | 8.1911.0-3.el8_2.1 | RHSA-2022:4800 |
| RHEL 8.1 E4S | rsyslog +15 | 8.37.0-13.el8_1.1 | RHSA-2022:4801 |
| RHEL 6 ELS | rsyslog +6 | 5.8.10-12.el6_10.1 | RHSA-2022:4808 |
| RHEL 6 ELS | rsyslog7 +7 | 7.4.10-7.el6_10.1 | RHSA-2022:4808 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | rsyslog +19 | 8.2102.0-7.el8 | ALSA-2022:4799 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | rsyslog | 8.2102.0-101.el9_0.1 | RLSA-2022:4795 |
| Rocky Linux 8 | rsyslog | 8.2102.0-7.el8_6.1 | RLSA-2022:4799 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | rsyslog | 8.2106.0-150200.4.26.1 | SUSE-SU-2022:1583-1 |
| SLES 15 SP2 | rsyslog | 8.2106.0-150200.4.26.1 | SUSE-SU-2022:1583-1 |
| SLES 15 SP1 | rsyslog | 8.33.1-150000.3.37.1 | SUSE-SU-2022:1817-1 |
| SLES 15 | rsyslog | 8.33.1-150000.3.37.1 | SUSE-SU-2022:1817-1 |
| SLES 12 SP5 | rsyslog | 8.2106.0-8.5.2 | SUSE-SU-2022:2314-1 |
Show 23 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP4 | rsyslog | 8.24.0-3.58.2 | SUSE-SU-2022:2331-1 |
| SLES 12 SP3 | rsyslog | 8.24.0-3.58.2 | SUSE-SU-2022:2331-1 |
| SLES 12 SP2 | rsyslog | 8.4.0-18.16.1 | SUSE-SU-2022:2333-1 |
| SLES for SAP 15 SP2 | rsyslog | 8.2106.0-150200.4.26.1 | SUSE-SU-2022:1583-1 |
| SLES for SAP 15 SP1 | rsyslog | 8.33.1-150000.3.37.1 | SUSE-SU-2022:1817-1 |
| SLES for SAP 15 | rsyslog | 8.33.1-150000.3.37.1 | SUSE-SU-2022:1817-1 |
| SLES for SAP 12 SP5 | rsyslog | 8.2106.0-8.5.2 | SUSE-SU-2022:2314-1 |
| SLES for SAP 12 SP4 | rsyslog | 8.24.0-3.58.2 | SUSE-SU-2022:2331-1 |
| SLES for SAP 12 SP3 | rsyslog | 8.24.0-3.58.2 | SUSE-SU-2022:2331-1 |
| SLE Real Time 15 SP2 | rsyslog | 8.2106.0-150200.4.26.1 | SUSE-SU-2022:1583-1 |
| SLE HPC 15 SP2 | rsyslog | 8.2106.0-150200.4.26.1 | SUSE-SU-2022:1583-1 |
| SLE HPC 15 SP1 | rsyslog | 8.33.1-150000.3.37.1 | SUSE-SU-2022:1817-1 |
| SLE HPC 15 | rsyslog | 8.33.1-150000.3.37.1 | SUSE-SU-2022:1817-1 |
| SUSE OpenStack Cloud Crowbar 9 | rsyslog | 8.24.0-3.58.2 | SUSE-SU-2022:2331-1 |
| SUSE OpenStack Cloud Crowbar 8 | rsyslog | 8.24.0-3.58.2 | SUSE-SU-2022:2331-1 |
| SUSE OpenStack Cloud 9 | rsyslog | 8.24.0-3.58.2 | SUSE-SU-2022:2331-1 |
| SUSE OpenStack Cloud 8 | rsyslog | 8.24.0-3.58.2 | SUSE-SU-2022:2331-1 |
| SUSE Manager Server 4.1 | rsyslog | 8.2106.0-150200.4.26.1 | SUSE-SU-2022:1583-1 |
| SUSE Manager Retail Branch Server 4.1 | rsyslog | 8.2106.0-150200.4.26.1 | SUSE-SU-2022:1583-1 |
| SUSE Manager Proxy 4.1 | rsyslog | 8.2106.0-150200.4.26.1 | SUSE-SU-2022:1583-1 |
| SUSE HPE Helion OpenStack 8 | rsyslog | 8.24.0-3.58.2 | SUSE-SU-2022:2331-1 |
| SUSE Enterprise Storage 7 | rsyslog | 8.2106.0-150200.4.26.1 | SUSE-SU-2022:1583-1 |
| SUSE Enterprise Storage 6 | rsyslog | 8.33.1-150000.3.37.1 | SUSE-SU-2022:1817-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | rsyslog | 8.2204.1-1.1 | openSUSE-SU-2024:12059-1 |
| openSUSE Leap 15.3 | rsyslog | 8.2106.0-150200.4.26.1 | SUSE-SU-2022:1583-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | rsyslog | 8.2204.1-r0 | — |
| Alpine v3.23 | rsyslog | 8.2204.1-r0 | — |
| Alpine v3.22 | rsyslog | 8.2204.1-r0 | — |
| Alpine v3.21 | rsyslog | 8.2204.1-r0 | — |
| Alpine v3.20 | rsyslog | 8.2204.1-r0 | — |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | rsyslog | 8.2204.1-r0 | — |
| Alpine v3.18 | rsyslog | 8.2204.1-r0 | — |
| Alpine v3.17 | rsyslog | 8.2204.1-r0 | — |
| Alpine v3.16 | rsyslog | 8.2204.1-r0 | — |
| Alpine v3.15 | rsyslog | 8.2108.0-r2 | — |
| Alpine v3.14 | rsyslog | 8.2012.0-r3 | — |
| Alpine v3.13 | rsyslog | 8.2012.0-r3 | — |
| Alpine v3.12 | rsyslog | 8.2004.0-r2 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | rsyslog +10 | 8.2204.0-3.amzn2023.0.2 | ALAS2023-2023-001 |
| Amazon Linux 2 | rsyslog +17 | 8.24.0-57.amzn2.2.0.1 | ALAS2-2022-1803 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | rsyslog | 8.2204.1-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | rsyslog +20 | 8.2102.0-101.el9_0.1 | ELSA-2022-4795 |
| Oracle Linux 8 | rsyslog +19 | 8.2102.0-7.el8_6.1 | ELSA-2022-4799 |
| Oracle Linux 7 | rsyslog +17 | 8.24.0-57.0.4.el7_9.3 | ELSA-2022-4803 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
andree554/CVE-2022-24903-Heap-based-buffer-overflow-Hand-On-Lab ★ 0 · Jul 30, 2026
CVE-2022-24903 Heap-based buffer overflow
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 35
- WID-SEC-2026-2189 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- ALSA-2022:4799 Important: rsyslog security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2022:5439 Red Hat Security Advisory: RHV-H security update (redhat-virtualization-host) 4.3.23 Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2022:4896 Red Hat Security Advisory: Red Hat Virtualization security, bug fix, and enhancement update [ovirt-4.5.0] Red Hat Security Advisories (RHSA) · Oct 9, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- RHSA-2022:4808 Red Hat Security Advisory: rsyslog and rsyslog7 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2022:4802 Red Hat Security Advisory: rsyslog security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2022:4803 Red Hat Security Advisory: rsyslog security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2022:4801 Red Hat Security Advisory: rsyslog security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2022:4800 Red Hat Security Advisory: rsyslog security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2022:4799 Red Hat Security Advisory: rsyslog security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2022:4795 Red Hat Security Advisory: rsyslog security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-5404-2 rsyslog vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-5404-1 rsyslog vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-5150-1 rsyslog - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3016-1 rsyslog - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2022:4795 Important: rsyslog security update Rocky Linux Security Advisories · Feb 4, 2026
- RLSA-2022:4799 Important: rsyslog security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2022:2314-1 Security update for rsyslog SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12059-1 rsyslog-8.2204.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2333-1 Security update for rsyslog SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2331-1 Security update for rsyslog SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:1817-1 Security update for rsyslog SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:1583-1 Security update for rsyslog SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-1542 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- ICSA-23-194-01 Siemens RUGGEDCOM ROX CISA ICS & IT advisories · May 6, 2025
- WID-SEC-2023-0137 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 21, 2024
- WID-SEC-2022-0123 rsyslog: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Aug 11, 2024
- WID-SEC-2023-1790 IBM Security Guardium: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 18, 2023
- SSA-146325 SSA-146325: Multiple Vulnerabilities in RUGGEDCOM ROX before V2.16 Siemens ProductCERT · Jul 11, 2023
- ALAS2023-2023-001 Important: rsyslog security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 22, 2023
- ELSA-2022-4795 Important: rsyslog security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 30, 2022
- ALAS2-2022-1803 Important: rsyslog security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jun 7, 2022
- ELSA-2022-4803 Important: rsyslog security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · May 31, 2022
- ELSA-2022-4799 Important: rsyslog security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 30, 2022
References
- https://github.com/rsyslog/rsyslog/security/advisories/GHSA-ggw7-xr6h-mmr8
- https://github.com/rsyslog/rsyslog/commit/f211042ecbb472f9d8beb4678a65d272b6f07705
- FEDORA-2022-f796a28a7b vendor-advisory
- [debian-lts-announce] 20220520 [SECURITY] [DLA 3016-1] rsyslog security update mailing-list
- DSA-5150 vendor-advisory
- https://security.netapp.com/advisory/ntap-20221111-0002/