Security Update for rsyslog: Remote Crash Vulnerability
Summary
ALSA-2026:67584: Moderate: rsyslog security update. Affects rsyslog versions < 8.2510.0-5.el10_2.1. Fixed in 8.2510.0-5.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rsyslog package is an enhanced, multi-threaded syslog daemon that provides logging capabilities for various systems. It supports features such as MySQL integration, syslog over TCP, RFC 3195 compliance, and advanced filtering options. This package is crucial for managing log data efficiently and securely. However, it has been found to have a configuration-dependent vulnerability in its optional imptcp input module, which can be exploited by an unauthenticated remote peer.
Vulnerability Detail
The vulnerability identified as CVE-2026-19654 allows an unauthenticated remote peer to crash the rsyslog daemon (rsyslogd) due to a configuration-dependent issue in the imptcp input module. This could lead to denial of service, where legitimate logging operations are disrupted, potentially impacting system monitoring and security auditing.
How To Fix
Minimum fixed version
8.2510.0-5.el10_2.1
This is the first release that contains the fix.
sudo dnf update rsyslogTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the imptcp input module in your rsyslog configuration to prevent exploitation until the package is updated. This can be done by commenting out or removing the relevant configuration lines in the rsyslog.conf file.
Conclusion
The rsyslog package has a moderate vulnerability that can be exploited by an unauthenticated remote peer, leading to potential denial of service. It is crucial to update to the patched version to mitigate this risk. Regular updates and monitoring are essential for maintaining system security.
See every vulnerability recorded for rsyslog →
FAQ
rsyslog is a high-performance syslog daemon that provides enhanced logging capabilities for various systems, allowing for structured logging and integration with databases.
CVE-2026-19654 refers to a specific vulnerability in the rsyslog package that allows an unauthenticated remote peer to crash the rsyslog daemon.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability can lead to denial of service, where the logging service becomes unavailable, impacting system monitoring and security auditing.
It is recommended to regularly check for updates and apply them promptly to ensure your system is protected against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for rsyslog.
