rsyslog CVE-2026-61548

The primary fix is to upgrade to rsyslog 8.2606.0, the first upstream release containing the corrected code. The upstream fix removes the fixed 32 KiB stack buffer entirely and replaces it with a dynamically allocated buffer sized to the validated input length plus one byte for the NUL terminator. For distributions maintaining stable downstream versions, the rsyslog project recommends a minimal backport: replace the stack-allocated pVal array with malloc((size_t)lenbuf + 1), pass the pointer to parsePARAM_VALUE(), and free it after use. If immediate upgrade is not possible, the following workarounds reduce exposure in descending order of effectiveness: first, remove or avoid loading mmpstrucdata in the rsyslog configuration if the module is not operationally required - this fully eliminates the affected code path; second, restrict network inputs so that attacker-controlled RFC 5424 messages cannot reach any rsyslog action that invokes mmpstrucdata; third, keep MaxMessageSize at or below a value that prevents any single structured-data parameter value from exceeding 32,768 bytes, noting that reducing MaxMessageSize may truncate legitimate large log messages and is not suitable for deployments specifically relying on large RFC 5424 messages. Refer to https://seclists.org/oss-sec/2026/q3/173 for disclosure details.