SB2026091622 - Multiple vulnerabilities in Graylog

Description

This security bulletin contains information about 2 vulnerabilities.

1) Inefficient regular expression complexity (CVE-ID: N/A)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in the Palo Alto Networks input parser when processing a specially crafted syslog message. A remote attacker can send a specially crafted syslog message to consume excessive CPU and occupy a message processing thread to cause a denial of service.

2) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a loop with an unreachable exit condition in the IPFIX input parser when processing a specially crafted IPFIX datagram. A remote attacker can send a specially crafted IPFIX datagram to cause a denial of service.

Restarting the node does not clear the condition, and message processing on unrelated inputs can also be blocked.

Remediation

Install update from vendor's website.

References

• https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-vpqc-v737-94g9
• https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-xwgc-q8x5-538w