rsyslog imhttp CVE-2026-55556

The primary remediation is upgrading to rsyslog 8.2604.0 or later, which removes the vulnerable Basic Authentication parser entirely via the auth refactor in commit acde2ba25ea33816694b787859f4a727a247b6d6 (https://github.com/rsyslog/rsyslog/commit/acde2ba25ea33816694b787859f4a727a247b6d6). For downstreams or organizations maintaining older branches that cannot take the full auth refactor, the reporter-provided minimal targeted fix is a one-line patch in contrib/imhttp/imhttp.c at the parse_auth_header() function: replace auth->pworkbuf = calloc(0, len) with auth->pworkbuf = calloc(1, len). As an immediate compensating control, disabling HTTP Basic Authentication on the imhttp endpoint (removing the basicauthfile parameter) eliminates the vulnerable code path entirely with no impact to log ingestion if an alternative auth method is used. Restricting network access to the imhttp listener port to trusted sources only via host-based or network firewall rules prevents remote exploitation without requiring a code change, though it does not address the underlying defect. The advisory is published at https://seclists.org/oss-sec/2026/q2/1004.