Heap-based buffer overflow in rsyslog - CVE-2026-78002

Vulnerability identifier: #VU146002

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-78002

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in the RainerScript replace() and three-argument wrap() implementation when processing attacker-controlled message content from network input with an affected ruleset. A remote attacker can send a specially crafted message to cause a denial of service.

Exposure requires a configuration that applies replace() or three-argument wrap() to untrusted message data received from a network input.

rsyslog
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Galera for Ericsson 15
SUSE Package Hub 15
Server Applications Module
Basesystem Module
Ubuntu
openEuler
rsyslog-debugsource
rsyslog
rsyslog-debuginfo
rsyslog-help
rsyslog-relp
rsyslog-rabbitmq
rsyslog-pgsql
rsyslog-omamqp1
rsyslog-mongodb
rsyslog-mmnormalize
rsyslog-mmkubernetes
rsyslog-kafka
rsyslog-hiredis
rsyslog-udpspoof
rsyslog-snmp
rsyslog-mmjsonparse
rsyslog-mmaudit
rsyslog-gssapi
rsyslog-gnutls
rsyslog-elasticsearch
rsyslog-crypto
rsyslog-mmsnmptrapd
rsyslog-mysql
rsyslog-mmtaghostname
rsyslog-module-snmp-debuginfo
rsyslog-module-gssapi
rsyslog-module-pgsql
rsyslog-module-relp-debuginfo
rsyslog-module-relp
rsyslog-module-snmp
rsyslog-module-gtls
rsyslog-module-mysql-debuginfo
rsyslog-module-mmnormalize-debuginfo
rsyslog-module-pgsql-debuginfo
rsyslog-module-mysql
rsyslog-module-udpspoof-debuginfo
rsyslog-module-kafka
rsyslog-module-kafka-debuginfo
rsyslog-devel
rsyslog-module-gtls-debuginfo
rsyslog-module-mmnormalize
rsyslog-module-udpspoof
rsyslog-module-gssapi-debuginfo
rsyslog-module-ossl-debuginfo
rsyslog-module-ossl
rsyslog (Ubuntu package)

Install security update from vendor's repository.

rsyslog - update to 141
rsyslog-debugsource - addressed in versions 8.2006.0-10, 8.2210.0-12, 8.2312.0-13
rsyslog - addressed in versions 8.2006.0-10, 8.2210.0-12, 8.2312.0-13
rsyslog-debuginfo - addressed in versions 8.2006.0-10, 8.2210.0-12, 8.2312.0-13
rsyslog-help - addressed in versions 8.2006.0-10, 8.2210.0-12, 8.2312.0-13
rsyslog-relp - addressed in versions 8.2006.0-10, 8.2210.0-12, 8.2312.0-13
rsyslog-rabbitmq - addressed in versions 8.2006.0-10, 8.2210.0-12, 8.2312.0-13
rsyslog-pgsql - addressed in versions 8.2006.0-10, 8.2210.0-12, 8.2312.0-13
rsyslog-omamqp1 - addressed in versions 8.2006.0-10, 8.2210.0-12, 8.2312.0-13
rsyslog-mongodb - addressed in versions 8.2006.0-10, 8.2210.0-12, 8.2312.0-13
rsyslog-mmnormalize - addressed in versions 8.2006.0-10, 8.2210.0-12, 8.2312.0-13
rsyslog-mmkubernetes - addressed in versions 8.2006.0-10, 8.2210.0-12, 8.2312.0-13
rsyslog-kafka - addressed in versions 8.2006.0-10, 8.2210.0-12, 8.2312.0-13
rsyslog-hiredis - addressed in versions 8.2006.0-10, 8.2210.0-12, 8.2312.0-13
rsyslog-udpspoof - addressed in versions 8.2210.0-12, 8.2312.0-13
rsyslog-snmp - addressed in versions 8.2210.0-12, 8.2312.0-13
rsyslog-mmjsonparse - addressed in versions 8.2210.0-12, 8.2312.0-13
rsyslog-mmaudit - addressed in versions 8.2210.0-12, 8.2312.0-13
rsyslog-gssapi - addressed in versions 8.2210.0-12, 8.2312.0-13
rsyslog-gnutls - addressed in versions 8.2210.0-12, 8.2312.0-13
rsyslog-elasticsearch - addressed in versions 8.2210.0-12, 8.2312.0-13
rsyslog-crypto - addressed in versions 8.2210.0-12, 8.2312.0-13
rsyslog-mmsnmptrapd - addressed in versions 8.2210.0-12, 8.2312.0-13
rsyslog-mysql - addressed in versions 8.2210.0-12, 8.2312.0-13
rsyslog-mmtaghostname - update to 8.2312.0-13
rsyslog-module-snmp-debuginfo - update to 8.2608.0-150700.3.24.1
rsyslog-module-gssapi - update to 8.2608.0-150700.3.24.1
rsyslog-module-pgsql - update to 8.2608.0-150700.3.24.1
rsyslog-module-relp-debuginfo - update to 8.2608.0-150700.3.24.1
rsyslog-module-relp - update to 8.2608.0-150700.3.24.1
rsyslog-module-snmp - update to 8.2608.0-150700.3.24.1
rsyslog-module-gtls - update to 8.2608.0-150700.3.24.1
rsyslog-module-mysql-debuginfo - update to 8.2608.0-150700.3.24.1
rsyslog-module-mmnormalize-debuginfo - update to 8.2608.0-150700.3.24.1
rsyslog-module-pgsql-debuginfo - update to 8.2608.0-150700.3.24.1
rsyslog-module-mysql - update to 8.2608.0-150700.3.24.1
rsyslog-module-udpspoof-debuginfo - update to 8.2608.0-150700.3.24.1
rsyslog-module-kafka - update to 8.2608.0-150700.3.24.1
rsyslog-module-kafka-debuginfo - update to 8.2608.0-150700.3.24.1
rsyslog-devel - update to 8.2608.0-150700.3.24.1
rsyslog-module-gtls-debuginfo - update to 8.2608.0-150700.3.24.1
rsyslog-module-mmnormalize - update to 8.2608.0-150700.3.24.1
rsyslog-module-udpspoof - update to 8.2608.0-150700.3.24.1
rsyslog-module-gssapi-debuginfo - update to 8.2608.0-150700.3.24.1
rsyslog-module-ossl-debuginfo - update to 8.2608.0-150700.3.24.1
rsyslog-debuginfo - update to 8.2608.0-150700.3.24.1
rsyslog - update to 8.2608.0-150700.3.24.1
rsyslog-module-ossl - update to 8.2608.0-150700.3.24.1
rsyslog-debugsource - update to 8.2608.0-150700.3.24.1
rsyslog (Ubuntu package) - addressed in versions 8.16.0-1ubuntu3.1+esm3, 8.32.0-1ubuntu4.2+esm1, 8.2001.0-1ubuntu1.3+esm1, 8.2112.0-2ubuntu2.5, 8.2312.0-3ubuntu9.4, 8.2512.0-1ubuntu4.2

• https://github.com/rsyslog/rsyslog/security/advisories/GHSA-g72f-gc6v-f2w3

• Remote denial of service in rsyslog
• openEuler 24.03 LTS SP4 update for rsyslog
• openEuler 24.03 LTS SP1 update for rsyslog
• openEuler 22.03 LTS SP4 update for rsyslog
• openEuler 20.03 LTS SP4 update for rsyslog
• openEuler 24.03 LTS SP3 update for rsyslog
• Ubuntu update for rsyslog
• SUSE update for rsyslog