SQL injection in syslog-ng SQL destination driver (CVE-2026-39879)

A missing sanitization call in `afsql_dd_run_query` allows SQL injection from an untrusted source in syslog-ng's SQL destination driver. This vulnerability is not present in default configurations; the SQL driver must be manually configured to be exposed. An adjacent, unauthenticated attacker could exploit this to affect data integrity or availability. Affected versions: - syslog-ng < 4.12 - syslog-ng Premium Edition < 8.2 - syslog-ng Store Box < 7.8 We recommend updating to: syslog-ng 4.12, syslog-ng Premium Edition 8.2, syslog-ng Store Box 7.8. CVSS 7.1 · our assessment: this_week Reference: https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-qwf9-6222-m24m Details: https://vuln.today/cve/CVE-2026-39879