Critical Security Flaw in rsyslog: Denial of Service via Heap Buffer Overflow
Summary
ALSA-2026:69540: Important: rsyslog security update. Affects rsyslog versions < 8.2510.0-2.el9_8.2. Fixed in 8.2510.0-2.el9_8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rsyslog package is a powerful, multi-threaded syslog daemon that enhances logging capabilities in Linux environments. It supports various features including MySQL integration, syslog over TCP, RFC 3195 compliance, and advanced filtering options. However, a critical vulnerability has been identified that could lead to a denial of service, impacting the reliability of logging services.
Vulnerability Detail
The vulnerability arises from a heap buffer overflow in the RainerScript replace() function within rsyslog. This flaw can be exploited by an attacker to cause a denial of service, potentially leading to system instability or crashes. The issue is tracked under CVE-2026-78002, and it poses a significant risk to systems running affected versions of rsyslog.
How To Fix
Minimum fixed version
8.2510.0-2.el9_8.2
This is the first release that contains the fix.
sudo dnf update rsyslogTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if immediate patching is not feasible, consider disabling the RainerScript functionality or restricting access to the syslog service to trusted sources only. This can help mitigate the risk of exploitation until the update is applied.
Conclusion
The rsyslog security update addresses a critical vulnerability that could lead to denial of service. It is crucial for users to update their systems to the latest patched version to ensure continued reliability and security of logging services.
See every vulnerability recorded for rsyslog →
FAQ
The vulnerability is a heap buffer overflow in the RainerScript replace() function, which can lead to a denial of service.
You can use the Vulert platform to check if your application is affected by this vulnerability. Visit Vulert Scanner for more details.
Exploitation of this vulnerability can cause system crashes and instability, affecting the logging services provided by rsyslog.
Yes, a patch is available in version 8.2510.0-2.el9_8.2 and later. Updating to this version will fix the vulnerability.
If you cannot apply the patch immediately, consider disabling RainerScript or restricting access to the syslog service as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for rsyslog.
