Description
A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat Update Infrastructure 5 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rsyslog | 8.2608.0-4 | — |
| Debian 13 | rsyslog | 8.2504.0-1+deb13u2 | — |
| Debian 12 | rsyslog | 8.2302.0-1+deb12u2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | rsyslog | 8.2512.0-1ubuntu4.2 | USN-8786-1 |
| Ubuntu 24.04 LTS | rsyslog | 8.2312.0-3ubuntu9.4 | USN-8786-1 |
| Ubuntu 22.04 LTS | rsyslog | 8.2112.0-2ubuntu2.5 | USN-8786-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | rsyslog | 8.2001.0-1ubuntu1.3+esm1 | USN-8786-1 |
| Ubuntu Pro 18.04 LTS | rsyslog | 8.32.0-1ubuntu4.2+esm1 | USN-8786-1 |
| Ubuntu Pro 16.04 LTS | rsyslog | 8.16.0-1ubuntu3.1+esm3 | USN-8786-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | rsyslog +19 | 8.2510.0-5.el10_2.2 | RHSA-2026:69541 |
| RHEL 9 | rsyslog +20 | 8.2510.0-2.el9_8.2 | RHSA-2026:69540 |
| RHEL 8 | rsyslog +1 | 8.2102.0-15.el8_10.3 | RHSA-2026:80817 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | rsyslog +19 | 8.2412.0-1.el10_0.2 | RHSA-2026:81321 |
| RHEL 9.6 EUS | rsyslog +19 | 8.2412.0-1.el9_6.2 | RHSA-2026:84576 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | rsyslog +19 | 8.2510.0-5.el10_2.2 | ALSA-2026:69541 |
| AlmaLinux 9 | rsyslog +20 | 8.2510.0-2.el9_8.2 | ALSA-2026:69540 |
| AlmaLinux 8 | rsyslog +19 | 8.2102.0-15.el8_10.3 | ALSA-2026:80817 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | rsyslog | 8.2510.0-5.el10_2.2 | RLSA-2026:69541 |
| Rocky Linux 9 | rsyslog | 8.2510.0-2.el9_8.2 | RLSA-2026:69540 |
| Rocky Linux 8 | rsyslog | 8.2102.0-15.el8_10.3 | RLSA-2026:80817 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | rsyslog | 8.2608.0-150700.3.24.1 | SUSE-SU-2026:4611-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | rsyslog | 8.2608.0-160000.1.1 | SUSE-SU-2026:24598-1 |
| SLES 16.0 | rsyslog | 8.2608.0-160000.1.1 | SUSE-SU-2026:24598-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | rsyslog | 8.2608.0-160000.1.1 | openSUSE-SU-2026:22184-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | rsyslog | 8.2608.0-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | rsyslog +11 | 8.2204.0-3.amzn2023.0.6 | ALAS2023-2026-2133 |
| Amazon Linux 2 | rsyslog +17 | 8.24.0-57.amzn2.2.0.3 | ALAS2-2026-3904 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | rsyslog | 8.2308.0-7 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | rsyslog +19 | 8.2510.0-5.el10_2.2 | ELSA-2026-69541 |
| Oracle Linux 9 | rsyslog +20 | 8.2510.0-2.0.1.el9_8.2 | ELSA-2026-69540 |
| Oracle Linux 8 | rsyslog +19 | 8.2102.0-15.0.1.el8_10.3 | ELSA-2026-80817 |
Advisories 21
- WID-SEC-2026-3094 rsyslog: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 12, 2026
- SUSE-SU-2026:24598-1 Security update for rsyslog SUSE / openSUSE Security Updates · Nov 10, 2026
- openSUSE-SU-2026:22184-1 Security update for rsyslog SUSE / openSUSE Security Updates · Oct 31, 2026
- ALSA-2026:69540 Important: rsyslog security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:69541 Important: rsyslog security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:80817 Important: rsyslog security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:84576 Red Hat Security Advisory: rsyslog security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:81321 Red Hat Security Advisory: rsyslog security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:80817 Red Hat Security Advisory: rsyslog security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:69541 Red Hat Security Advisory: rsyslog security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:69540 Red Hat Security Advisory: rsyslog security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RLSA-2026:80817 Important: rsyslog security update Rocky Linux Security Advisories · Oct 14, 2026
- ELSA-2026-80817 Important: rsyslog security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 12, 2026
- SUSE-SU-2026:4611-1 Security update for rsyslog SUSE / openSUSE Security Updates · Oct 10, 2026
- RLSA-2026:69540 Important: rsyslog security update Rocky Linux Security Advisories · Sep 24, 2026
- RLSA-2026:69541 Important: rsyslog security update Rocky Linux Security Advisories · Sep 23, 2026
- ELSA-2026-69540 Important: rsyslog security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Sep 22, 2026
- USN-8786-1 rsyslog vulnerability Ubuntu Security Notices (USN) · Sep 21, 2026
- ELSA-2026-69541 Important: rsyslog security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Sep 21, 2026
- ALAS2023-2026-2133 Important: rsyslog security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 14, 2026
- ALAS2-2026-3904 Important: rsyslog security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 14, 2026
References
- RHSA-2026:69540 vendor-advisory
- RHSA-2026:69541 vendor-advisory
- RHSA-2026:71603 vendor-advisory
- RHSA-2026:80817 vendor-advisory
- RHSA-2026:81321 vendor-advisory
- RHSA-2026:84576 vendor-advisory
- RHSA-2026:86124 vendor-advisory
- RHSA-2026:87408 vendor-advisory
- RHSA-2026:90349 vendor-advisory
- RHSA-2026:91582 vendor-advisory
- RHSA-2026:95573 vendor-advisory
- RHSA-2026:96085 vendor-advisory
- RHSA-2026:98456 vendor-advisory
- RHSA-2026:98558 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-78002 vdb-entry
- RHBZ#2521135 issue-tracking
- https://github.com/rsyslog/rsyslog/security/advisories/GHSA-g72f-gc6v-f2w3