Critical Security Flaw in rsyslog: Denial of Service via Heap Buffer Overflow
Summary
ALSA-2026:69541: Important: rsyslog security update. Affects rsyslog versions < 8.2510.0-5.el10_2.2. Fixed in 8.2510.0-5.el10_2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rsyslog package is an advanced, multi-threaded syslog daemon that enhances logging capabilities in Linux environments. It supports various features such as MySQL integration, syslog over TCP, RFC 3195 compliance, and offers extensive filtering and formatting options. However, it is susceptible to a critical vulnerability that can lead to denial of service.
Vulnerability Detail
The vulnerability identified as CVE-2026-78002 is a heap buffer overflow in the RainerScript replace() function of rsyslog. This flaw can be exploited by an attacker to cause a denial of service, potentially crashing the rsyslog service and disrupting logging operations. The issue arises from improper handling of input data, allowing for maliciously crafted messages to overflow the buffer.
How To Fix
Minimum fixed version
8.2510.0-5.el10_2.2
This is the first release that contains the fix.
sudo dnf update rsyslogTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the input to the rsyslog service by implementing stricter filtering rules or disabling certain features that may expose the service to potential exploitation until the update is applied.
Conclusion
The rsyslog package has a critical vulnerability (CVE-2026-78002) that can lead to denial of service due to a heap buffer overflow. Users are strongly advised to update to the patched version to ensure system security and stability. For ongoing monitoring, consider using Vulert to keep track of vulnerabilities in your open-source dependencies.
See every vulnerability recorded for rsyslog →
FAQ
CVE-2026-78002 is a vulnerability in the rsyslog package that allows for a denial of service due to a heap buffer overflow in the RainerScript replace() function.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to install any software.
Exploitation of this vulnerability can lead to a denial of service, causing the rsyslog service to crash and interrupting logging operations, which may affect system monitoring and security.
Yes, a patch is available. Users should update their rsyslog package to version 8.2510.0-5.el10_2.2 or later to address this vulnerability.
If immediate updating is not possible, consider implementing stricter input filtering or disabling vulnerable features in rsyslog as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for rsyslog.
