Stack-based buffer overflow in rsyslog - CVE-2026-61548

Vulnerability identifier: #VU138583

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-61548

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to stack-based buffer overflow in the mmpstrucdata plugin parseSD_PARAM()/parsePARAM_VALUE() handling when parsing oversized RFC5424 structured-data parameter values. A remote attacker can send a specially crafted RFC5424 message to cause a denial of service.

Only deployments where the optional plugin is installed, explicitly loaded and used, attacker-controlled RFC5424 structured data reaches that action, and MaxMessageSize is high enough to permit an oversized parameter value are vulnerable.

rsyslog
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Package Hub 15
Server Applications Module
Basesystem Module
openSUSE Leap
Ubuntu
rsyslog-module-pgsql
rsyslog-module-mysql
rsyslog-module-gtls
rsyslog-module-gssapi-debuginfo
rsyslog-module-relp
rsyslog-module-pgsql-debuginfo
rsyslog-module-relp-debuginfo
rsyslog-diag-tools
rsyslog
rsyslog-module-udpspoof-debuginfo
rsyslog-module-mysql-debuginfo
rsyslog-module-mmnormalize
rsyslog-module-snmp
rsyslog-module-gtls-debuginfo
rsyslog-doc
rsyslog-debugsource
rsyslog-module-gssapi
rsyslog-debuginfo
rsyslog-module-snmp-debuginfo
rsyslog-module-mmnormalize-debuginfo
rsyslog-module-udpspoof
rsyslog-diag-tools-debuginfo
rsyslog (Ubuntu package)
rsyslog-module-gcrypt-debuginfo
rsyslog-module-dbi-debuginfo
rsyslog-module-omamqp1
rsyslog-module-ossl-debuginfo
rsyslog-module-kafka-debuginfo
rsyslog-module-gcrypt
rsyslog-module-elasticsearch-debuginfo
rsyslog-module-omtcl-debuginfo
rsyslog-module-ossl
rsyslog-module-omtcl
rsyslog-module-elasticsearch
rsyslog-module-omhttpfs
rsyslog-module-dbi
rsyslog-module-omhttpfs-debuginfo
rsyslog-module-kafka
rsyslog-module-omamqp1-debuginfo

Install security update from vendor's website.

rsyslog - update to 8.2606.0
rsyslog-module-pgsql - addressed in versions 8.2106.0-8.22.1, 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1, 8.2406.0-150700.3.7.1
rsyslog-module-mysql - addressed in versions 8.2106.0-8.22.1, 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1, 8.2406.0-150700.3.7.1
rsyslog-module-gtls - addressed in versions 8.2106.0-8.22.1, 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1, 8.2406.0-150700.3.7.1
rsyslog-module-gssapi-debuginfo - addressed in versions 8.2106.0-8.22.1, 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1, 8.2406.0-150700.3.7.1
rsyslog-module-relp - addressed in versions 8.2106.0-8.22.1, 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1, 8.2406.0-150700.3.7.1
rsyslog-module-pgsql-debuginfo - addressed in versions 8.2106.0-8.22.1, 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1, 8.2406.0-150700.3.7.1
rsyslog-module-relp-debuginfo - addressed in versions 8.2106.0-8.22.1, 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1, 8.2406.0-150700.3.7.1
rsyslog-diag-tools - addressed in versions 8.2106.0-8.22.1, 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1
rsyslog - addressed in versions 8.2106.0-8.22.1, 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1, 8.2406.0-150700.3.7.1
rsyslog-module-udpspoof-debuginfo - addressed in versions 8.2106.0-8.22.1, 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1, 8.2406.0-150700.3.7.1
rsyslog-module-mysql-debuginfo - addressed in versions 8.2106.0-8.22.1, 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1, 8.2406.0-150700.3.7.1
rsyslog-module-mmnormalize - addressed in versions 8.2106.0-8.22.1, 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1, 8.2406.0-150700.3.7.1
rsyslog-module-snmp - addressed in versions 8.2106.0-8.22.1, 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1, 8.2406.0-150700.3.7.1
rsyslog-module-gtls-debuginfo - addressed in versions 8.2106.0-8.22.1, 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1, 8.2406.0-150700.3.7.1
rsyslog-doc - addressed in versions 8.2106.0-8.22.1, 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1
rsyslog-debugsource - addressed in versions 8.2106.0-8.22.1, 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1, 8.2406.0-150700.3.7.1
rsyslog-module-gssapi - addressed in versions 8.2106.0-8.22.1, 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1, 8.2406.0-150700.3.7.1
rsyslog-debuginfo - addressed in versions 8.2106.0-8.22.1, 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1, 8.2406.0-150700.3.7.1
rsyslog-module-snmp-debuginfo - addressed in versions 8.2106.0-8.22.1, 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1, 8.2406.0-150700.3.7.1
rsyslog-module-mmnormalize-debuginfo - addressed in versions 8.2106.0-8.22.1, 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1, 8.2406.0-150700.3.7.1
rsyslog-module-udpspoof - addressed in versions 8.2106.0-8.22.1, 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1, 8.2406.0-150700.3.7.1
rsyslog-diag-tools-debuginfo - addressed in versions 8.2106.0-8.22.1, 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1
rsyslog (Ubuntu package) - addressed in versions 8.2112.0-2ubuntu2.4, 8.2312.0-3ubuntu9.3, 8.2512.0-1ubuntu4.1
rsyslog-module-gcrypt-debuginfo - addressed in versions 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1
rsyslog-module-dbi-debuginfo - addressed in versions 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1
rsyslog-module-omamqp1 - addressed in versions 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1
rsyslog-module-ossl-debuginfo - addressed in versions 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1, 8.2406.0-150700.3.7.1
rsyslog-module-kafka-debuginfo - addressed in versions 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1, 8.2406.0-150700.3.7.1
rsyslog-module-gcrypt - addressed in versions 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1
rsyslog-module-elasticsearch-debuginfo - addressed in versions 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1
rsyslog-module-omtcl-debuginfo - addressed in versions 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1
rsyslog-module-ossl - addressed in versions 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1, 8.2406.0-150700.3.7.1
rsyslog-module-omtcl - addressed in versions 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1
rsyslog-module-elasticsearch - addressed in versions 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1
rsyslog-module-omhttpfs - addressed in versions 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1
rsyslog-module-dbi - addressed in versions 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1
rsyslog-module-omhttpfs-debuginfo - addressed in versions 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1
rsyslog-module-kafka - addressed in versions 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1, 8.2406.0-150700.3.7.1
rsyslog-module-omamqp1-debuginfo - addressed in versions 8.2306.0-150400.5.40.1, 8.2406.0-150600.12.16.1

• https://github.com/rsyslog/rsyslog/security/advisories/GHSA-8qmr-c66f-g368

• Stack-based buffer overflow in rsyslog
• Ubuntu update for rsyslog
• SUSE update for rsyslog
• SUSE update for rsyslog
• SUSE update for rsyslog
• SUSE update for rsyslog