CVE-2026-19654

RSYSLOG is the rocket-fast system for log processing.It offers high-performance, great security features and a modular design. While it started as a regular syslogd, rsyslog has evolved into a kind of swiss army knife of logging, being able to accept inputs from a wide variety of sources, transform them, and output to the results to diverse destinations.

Security Fix(es):

A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.(CVE-2026-19654)

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format.

Security Fix(es):

• rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd (CVE-2026-19654)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format.

Security Fix(es):

• rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd (CVE-2026-19654)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format.

Security Fix(es):

• rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd (CVE-2026-19654)

• rsyslog: rsyslog: Denial of service via heap buffer overflow in RainerScript replace() function (CVE-2026-78002)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format.

Security Fix(es):

• rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd (CVE-2026-19654)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format.

Security Fix(es):

• rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd (CVE-2026-19654)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format.

Security Fix(es):

• rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd (CVE-2026-19654)
• rsyslog: rsyslog: Denial of service via heap buffer overflow in RainerScript replace() function (CVE-2026-78002)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.

• CVE-2026-19654: imptcp: guard regex framing match at line start

• CVE-2026-19654: remote crash in imptcp regex framing; oversize-frame recovery can zero iCurrLine, making processDataRcvd_regexFraming() submit a negative message length

• SECURITY UPDATE: denial of service in the optional imptcp module: a regex match at offset zero after oversize-frame recovery submits a negative message length and crashes rsyslogd
  • debian/patches/CVE-2026-19654.patch: denial of service in the optional imptcp module: a regex match at offset zero after oversize-frame recovery submits a negative message length and crashes rsyslogd
  • CVE-2026-19654
• debian/patches/Skip-tests-that-cannot-run-in-the-build-environment.patch: skip omfile-read-only, omfile-read-only-errmsg, privdropuser and privdropuserid. All four fail in the pdebuild chroot for reasons unrelated to rsyslog (root bypasses the 0400 mode the first two rely on; the chroot has no unprivileged test user for the last two), and they fail identically on the unpatched vendor sources.

• SECURITY UPDATE: Denial of service in the optional imptcp module
  • debian/patches/CVE-2026-19654.patch: guard the regex framing match at line start in plugins/imptcp/imptcp.c, so a match at offset zero after oversize-frame recovery can no longer submit a negative message length
  • CVE-2026-19654

• CVE-2026-19654: imptcp: guard regex framing match at line start

• CVE-2026-19654: imptcp: guard regex framing match at line start

• CVE-2026-19654: guard imptcp regex framing match at line start to prevent a negative message length after oversize-frame recovery

This update for rsyslog fixes the following issues:

• CVE-2026-19654: imptcp regex-framing remote denial of service (bsc#1271910).
• CVE-2026-61548: crafted RFC 5424 messages to mmpstrucdata can lead to a stack overwrite (bsc#1272414).
• CVE-2026-78002: RainerScript replace() heap buffer overflow (bsc#1275926).
• CVE-2026-92709: omfile dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling, which can lead to arbitrary code execution (bsc#1286926).
• RainerScript replace() length wrap (bsc#1285036).

Changes for rsyslog:

• added new rsyslog (imdtls/omdtls) DTLS modules (jsc#PED-16623)
• upgrade to rsyslog 8.2608.0 (bsc#1257604)

• 2026-08-18: imbeats: rearm listener after failed TLS accept
• 2026-08-18: msg: serialize turbo snapshot duplication
• 2026-08-18: omfile: harden dynafile default containment
• 2026-08-18: fixup! omfwd: support PKCS#11 URIs with ossl TLS
• 2026-07-02: omfwd: support PKCS#11 URIs with ossl TLS
• 2026-07-21: mmkubernetes: reload SA token proactively and on HTTP 401
• 2026-08-17: devtools: remove Cubic from local validation
• 2026-08-14: mmnormalize: share turbo $! snapshot across MsgDup by refcount
• 2026-08-11: tcpsrv: synchronize session table slots
• 2026-08-11: imrelp: preserve errno across stop signal
• 2026-08-12: examples.rst: Missing space in template
• 2026-08-10: mmnormalize: merge debug metadata
• 2026-08-08: normalizers: complete debug test gating
• 2026-08-08: normalizers: complete debug integration
• 2026-08-07: mmnormalize, pmnormalize: add liblognorm debugging
• 2026-08-07: msg: ignore null values in msgSetPropViaJSON() instead of crashing
• 2026-08-07: runtime: make error-message flag atomic
• 2026-07-24: fuzz: exercise RFC 3164 and RFC 5424 parsers
• 2026-08-05: build: unify indentation in AC_CONFIG_FILES list
• 2026-07-25: imfile: fix delay.message microsecond conversion
• 2026-07-24: diskqueue: reject symlinked persisted segments
• 2026-06-23: omfile: control symlink following
• 2026-07-25: mmnormalize: make HUP reload worker-safe
• 2026-07-24: docs(agents): add Cursor Cloud environment setup notes
• 2026-07-22: imbeats: harden Lumberjack input resource handling
• 2026-07-23: stringbuf: harden empty string replacement
• 2026-07-20: imptcp: guard regex framing match at line start (CVE-2026-19654 bsc#1271910)
• 2026-07-21: rainerscript: free cnfstmtNewAct nvlst once, at the done: label
• 2026-07-21: queue: preserve DA child work during shutdown
• 2026-07-21: imtcp: release completed zlib decoder state
• 2026-07-09: doc: clarify JSON array rendering
• 2026-07-21: Potential fixes for 5 code quality findings (#7397)
• 2026-07-20: ratelimit: optimize port-based per-source keys
• 2026-07-20: imtcp: make zstd window budget configurable
• 2026-07-19: imtcp: use snake case for zstd window tracking
• 2026-07-17: imtcp: bound aggregate zstd decoder window memory
• 2026-07-20: statsobj: guard Prometheus escape writes
• 2026-07-18: config: do not instantiate actions disabled via config.enabled="off"
• 2026-07-15: queue: document DA engine internals
• 2026-07-14: msg: enforce source-property helper contract
• 2026-07-10: ratelimit: remove per-source key policy hot lock
• 2026-07-08: ratelimit: speed source-key shortcuts
• 2026-07-15: queue: clarify DA transfer worker role
• 2026-07-18: compat_queue: add missing STAILQ_FOREACH/STAILQ_NEXT fallback
• 2026-07-18: rainerscript: warn on constant AND/OR operand at parse time
• 2026-07-18: configure: include <stddef.h> in the STAILQ detection test
• 2026-07-17: mmnormalize: share Turbo CEE root path check
• 2026-07-17: mmnormalize: fall back after Turbo materialization failure
• 2026-07-17: mmnormalize: preserve turbo results across message boundaries
• 2026-07-17: benchmarks: harden comparison and helper inputs
• 2026-07-16: segdisk: optimize CRC accounting and add benchmarks
• 2026-07-15: imjournal: stop invalidation reopen…

This update for rsyslog fixes the following issues:

• imdtls permitted-peer authorization bypass (bsc#1281628).

Changes for rsyslog:

• Upgrade to version 8.2608.0 (bsc#1257604)