Skip to main content

rsyslogd CVE-2026-19654

| EUVDEUVD-2026-57617 HIGH
Out-of-bounds Read (CWE-125)
2026-08-12 redhat
Privilege Escalation RCE Buffer Overflow Information Disclosure Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat
7.5
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Network-reachable unauthenticated crash with no C/I impact; AC:L because the non-default framing is a server configuration prerequisite, not attacker-side complexity once exposed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 12, 2026 - 21:37 vuln.today
CVE Published
Aug 12, 2026 - 20:46 nvd
HIGH 7.5

DescriptionCVE.org

A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.

AnalysisAI

Unauthenticated remote crash of rsyslogd is possible through a flaw in the optional imptcp input module, where a crafted input sequence during oversize-frame recovery produces an invalid internal message length and terminates the logging daemon. Systems running Red Hat Enterprise Linux 6 through 10 are affected only when imptcp is explicitly loaded with a non-default frame delimiting mode; the default imptcp framing and the separate imtcp module are explicitly confirmed unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis; CVSS scores this at 7.5 High solely on the basis of network-accessible, unauthenticated availability impact.

Technical ContextAI

rsyslogd is the primary system logging daemon shipped with Red Hat Enterprise Linux and many other Linux distributions. The vulnerability resides in the optional imptcp (Input Module for Plain TCP Syslog) plugin, specifically within the oversize-frame recovery code path. CWE-125 (Out-of-bounds Read) indicates the root cause is a memory read operation that extends beyond the valid buffer boundary, producing a corrupted internal message length value that drives rsyslogd to an invalid state and process termination. The flaw is exclusively triggered by non-default TCP frame delimiting modes within imptcp; the standard octet-counting and non-transparent framing defaults do not exercise the vulnerable path. CPE data from Red Hat confirms the affected software surface spans the rsyslog package bundled with RHEL 6, 7, 8, 9, and 10.

RemediationAI

No exact patched version number is confirmed in the available intelligence; administrators should verify fix availability directly through the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-19654 and the upstream GitHub advisory at https://github.com/rsyslog/rsyslog/security/advisories/GHSA-cj5r-wh2m-7w29, and apply the vendor-released update when confirmed. As an immediate compensating control with no logging functionality loss for most sites, administrators who do not specifically require imptcp in non-default framing mode should reconfigure rsyslogd to use either imtcp or the default imptcp framing, which eliminates the vulnerable code path entirely. Where non-default imptcp framing is operationally required and patching is delayed, restrict the TCP syslog ingestion port to known trusted source IP ranges via host-based firewall rules (iptables or nftables); this reduces the pool of peers who can trigger the crash but does not eliminate the vulnerability and may not be effective if trusted sources are themselves compromised.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

CVE-2026-19654 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy