Improper Neutralization of Special Elements in Graylog Forwarder and Graylog - CVE-2026-55841
Published: June 25, 2026
Vulnerability identifier: #VU135296
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-55841
CWE-ID: CWE-138
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to modify or delete log message fields and cause log messages to be discarded.
The vulnerability exists due to improper neutralization of special elements in the syslog message parser when parsing key-value formatted syslog messages. A remote attacker can send a specially crafted syslog message to modify or delete log message fields and cause log messages to be discarded.
This can enable log evasion techniques that obscure malicious activity.
Affected software
Graylog Forwarder
Graylog
Graylog
How to mitigate CVE-2026-55841
Install security update from vendor's website.
Graylog Forwarder - update to 7.3
Graylog - addressed in versions 6.3.12, 7.0.7, 7.1.2
Graylog - addressed in versions 6.3.12, 7.0.7, 7.1.2