What is the CVSS score of CVE-2026-39879?

CVE-2026-39879 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.2%.

Which versions of syslog-ng are affected by CVE-2026-39879?

syslog-ng's SQL destination driver (versions before 4.12) is vulnerable to SQL injection when processing untrusted log sources, risking unauthorized database modifications and logging service…. A patch is available.

How to fix or mitigate CVE-2026-39879?

Within 24 hours, inventory all syslog-ng deployments with manually configured SQL destination drivers and determine which accept untrusted log sources; if not operationally critical, disable the SQL driver immediately. Over the next 7 days, restrict log sources to explicitly trusted internal hosts only, enforce strict network segmentation between syslog-ng and the SQL database, and configure input validation and filtering to sanitize log data before SQL processing. Within 30 days, monitor vendor advisories for patches; upgrade affected instances to syslog-ng 4.12 or later, Premium Edition 8.2 or later, or Store Box 7.8 or later as these versions become available.

syslog-ng CVE-2026-39879

EUVD-2026-46031 HIGH

Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150)

2026-07-20 GitHub_M

SQLi Syslog Ng Red Hat Suse

7.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

vuln.today AI

6.5 MEDIUM

Log data is typically network-delivered from untrusted senders (AV:N) needing no auth (PR:N), but the non-default afsql SQL driver must be configured (AC:H); impact is DB integrity and availability, not confidentiality.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.1 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Patch available

Jul 20, 2026 - 18:18 EUVD

Analysis Generated

Jul 20, 2026 - 18:10 vuln.today

CVE Published

Jul 20, 2026 - 16:57 cve.org

HIGH 7.1

DescriptionCVE.org

Due to a missing sanitization call in afsql_dd_run_query, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured.

Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and syslog-ng Store Box 7.8

AnalysisAI

SQL injection in syslog-ng versions before 4.12 (also fixed in Premium Edition 8.2 and Store Box 7.8) allows an attacker who controls an untrusted log source to inject SQL through log data processed by the afsql SQL destination driver, because afsql_dd_run_query omits a required sanitization call. Exploitation only affects deployments that have manually configured the SQL driver, and there is no public exploit identified at time of analysis and no CISA KEV listing. The rated impact centers on integrity of the backing database and availability of the logging pipeline (CVSS 7.1).

Technical ContextAI

syslog-ng is a widely used log collection and routing daemon; the affected component is its afsql destination driver (modules/afsql/afsql.c), which forwards received log messages into a relational database backend (e.g., MySQL/PostgreSQL/SQLite) using template-expanded SQL statements. The root cause is CWE-150 (Improper Neutralization of Escape, Meta, or Control Sequences): the afsql_dd_run_query function builds and executes a query from log-derived values without invoking the escaping/sanitization routine, so attacker-controlled fields from an incoming log message are interpreted as SQL syntax rather than data. Because log content routinely originates from remote, untrusted syslog senders, any field mapped into the SQL columns becomes an injection vector when the SQL driver is enabled.

RemediationAI

Vendor-released patch: upgrade to syslog-ng 4.12 (Open Source Edition), syslog-ng Premium Edition 8.2, or syslog-ng Store Box 7.8, which add the missing sanitization in afsql_dd_run_query; see the advisory at https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-qwf9-6222-m24m. If immediate patching is not possible, the highest-value compensating control is to disable or remove the afsql SQL destination driver from the configuration, since the vulnerability is inert without it - the trade-off is losing direct database logging, which can be replaced by writing to files or a message queue and loading into the database out-of-band. Where the SQL destination must remain enabled, restrict which senders can reach the syslog-ng listener (firewall the syslog TCP/UDP/RELP/network ports to trusted log sources only) and, at the database layer, run syslog-ng's DB account with least privilege (INSERT-only to a dedicated logging schema, no DROP/ALTER/cross-table access) so that any residual injection cannot pivot beyond the log tables; the trade-off is that legitimate log sources behind untrusted network segments may need relays or authenticated transport.