CVE-2026-78002

RSYSLOG is the rocket-fast system for log processing.It offers high-performance, great security features and a modular design. While it started as a regular syslogd, rsyslog has evolved into a kind of swiss army knife of logging, being able to accept inputs from a wide variety of sources, transform them, and output to the results to diverse destinations.

Security Fix(es):

Rsyslog is an open-source log processing system. The replace() function in the RainerScript scripting language has a heap buffer overflow vulnerability due to incorrect calculation of buffer size (CWE-131), leading to a heap-based buffer overflow (CWE-122). An attacker could exploit this vulnerability to cause denial of service or potential code execution.(CVE-2026-78002)

RSYSLOG is the rocket-fast system for log processing.It offers high-performance, great security features and a modular design. While it started as a regular syslogd, rsyslog has evolved into a kind of swiss army knife of logging, being able to accept inputs from a wide variety of sources, transform them, and output to the results to diverse destinations.

Security Fix(es):

Rsyslog is an open-source log processing system. The replace() function in the RainerScript scripting language has a heap buffer overflow vulnerability due to incorrect calculation of buffer size (CWE-131), leading to a heap-based buffer overflow (CWE-122). An attacker could exploit this vulnerability to cause denial of service or potential code execution.(CVE-2026-78002)

RSYSLOG is the rocket-fast system for log processing.It offers high-performance, great security features and a modular design. While it started as a regular syslogd, rsyslog has evolved into a kind of swiss army knife of logging, being able to accept inputs from a wide variety of sources, transform them, and output to the results to diverse destinations.

Security Fix(es):

Rsyslog is an open-source log processing system. The replace() function in the RainerScript scripting language has a heap buffer overflow vulnerability due to incorrect calculation of buffer size (CWE-131), leading to a heap-based buffer overflow (CWE-122). An attacker could exploit this vulnerability to cause denial of service or potential code execution.(CVE-2026-78002)

RSYSLOG is the rocket-fast system for log processing.It offers high-performance, great security features and a modular design. While it started as a regular syslogd, rsyslog has evolved into a kind of swiss army knife of logging, being able to accept inputs from a wide variety of sources, transform them, and output to the results to diverse destinations.

Security Fix(es):

Rsyslog is an open-source log processing system. The replace() function in the RainerScript scripting language has a heap buffer overflow vulnerability due to incorrect calculation of buffer size (CWE-131), leading to a heap-based buffer overflow (CWE-122). An attacker could exploit this vulnerability to cause denial of service or potential code execution.(CVE-2026-78002)

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format.

Security Fix(es):

• rsyslog: rsyslog: Denial of service via heap buffer overflow in RainerScript replace() function (CVE-2026-78002)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format.

Security Fix(es):

• rsyslog: rsyslog: Denial of service via heap buffer overflow in RainerScript replace() function (CVE-2026-78002)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format.

Security Fix(es):

• rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd (CVE-2026-19654)

• rsyslog: rsyslog: Denial of service via heap buffer overflow in RainerScript replace() function (CVE-2026-78002)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript replace() function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format.

Security Fix(es):

• rsyslog: rsyslog: Denial of service via heap buffer overflow in RainerScript replace() function (CVE-2026-78002)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format.

Security Fix(es):

• rsyslog: rsyslog: Denial of service via heap buffer overflow in RainerScript replace() function (CVE-2026-78002)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format.

Security Fix(es):

• rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd (CVE-2026-19654)
• rsyslog: rsyslog: Denial of service via heap buffer overflow in RainerScript replace() function (CVE-2026-78002)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript replace() function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.

• CVE-2026-78002: rainerscript: rewind the replace() sizing pass in doFuncReplace() by the full failed partial-match length so the allocated buffer matches what the copy pass writes

• CVE-2026-78002: heap buffer overflow in RainerScript replace(); rewind the sizing pass by the full failed partial-match length so the allocated buffer matches what the copy pass writes

• SECURITY UPDATE: Heap buffer overflow in RainerScript replace()
  • debian/patches/CVE-2026-78002.patch: rewind the sizing pass by the full failed partial-match length in doFuncReplace() in grammar/rainerscript.c, so the allocated result matches what the copy pass writes
  • debian/patches/CVE-2026-78002-tests.patch: add regression test tests/rscript_replace-overlap.sh covering replace() with an overlapping partial match (the overflow trigger)
  • CVE-2026-78002

• SECURITY UPDATE: Heap buffer overflow in RainerScript replace()
  • debian/patches/CVE-2026-78002.patch: rewind the sizing pass by the full failed partial-match length in doFuncReplace() in grammar/rainerscript.c, so the allocated result matches what the copy pass writes
  • debian/patches/CVE-2026-78002-tests.patch: add regression test tests/rscript_replace-overlap.sh covering replace() with an overlapping partial match (the overflow trigger)
  • CVE-2026-78002

• SECURITY UPDATE: Heap buffer overflow in RainerScript replace()
  • debian/patches/CVE-2026-78002.patch: rewind the sizing pass by the full failed partial-match length in doFuncReplace() in grammar/rainerscript.c, so the allocated result matches what the copy pass writes
  • debian/patches/CVE-2026-78002-tests.patch: add regression test tests/rscript_replace-overlap.sh covering replace() with an overlapping partial match (the overflow trigger)
  • CVE-2026-78002

• CVE-2026-78002: rainerscript: align replace() sizing rewind in doFuncReplace()

• CVE-2026-78002: rainerscript: align replace() sizing rewind in doFuncReplace()

• CVE-2026-78002: rainerscript: align replace() sizing rewind in doFuncReplace()

• SECURITY UPDATE: Heap buffer overflow in RainerScript replace()
  • debian/patches/CVE-2026-78002.patch: rewind the replace() sizing pass by the full failed partial-match length so the allocated buffer matches what the copy pass writes, and add a regression test
  • debian/rules: make the new regression test executable before running the testsuite
  • CVE-2026-78002

This update for rsyslog fixes the following issues:

• CVE-2026-19654: imptcp regex-framing remote denial of service (bsc#1271910).
• CVE-2026-61548: crafted RFC 5424 messages to mmpstrucdata can lead to a stack overwrite (bsc#1272414).
• CVE-2026-78002: RainerScript replace() heap buffer overflow (bsc#1275926).
• CVE-2026-92709: omfile dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling, which can lead to arbitrary code execution (bsc#1286926).
• RainerScript replace() length wrap (bsc#1285036).

Changes for rsyslog:

• added new rsyslog (imdtls/omdtls) DTLS modules (jsc#PED-16623)
• upgrade to rsyslog 8.2608.0 (bsc#1257604)

• 2026-08-18: imbeats: rearm listener after failed TLS accept
• 2026-08-18: msg: serialize turbo snapshot duplication
• 2026-08-18: omfile: harden dynafile default containment
• 2026-08-18: fixup! omfwd: support PKCS#11 URIs with ossl TLS
• 2026-07-02: omfwd: support PKCS#11 URIs with ossl TLS
• 2026-07-21: mmkubernetes: reload SA token proactively and on HTTP 401
• 2026-08-17: devtools: remove Cubic from local validation
• 2026-08-14: mmnormalize: share turbo $! snapshot across MsgDup by refcount
• 2026-08-11: tcpsrv: synchronize session table slots
• 2026-08-11: imrelp: preserve errno across stop signal
• 2026-08-12: examples.rst: Missing space in template
• 2026-08-10: mmnormalize: merge debug metadata
• 2026-08-08: normalizers: complete debug test gating
• 2026-08-08: normalizers: complete debug integration
• 2026-08-07: mmnormalize, pmnormalize: add liblognorm debugging
• 2026-08-07: msg: ignore null values in msgSetPropViaJSON() instead of crashing
• 2026-08-07: runtime: make error-message flag atomic
• 2026-07-24: fuzz: exercise RFC 3164 and RFC 5424 parsers
• 2026-08-05: build: unify indentation in AC_CONFIG_FILES list
• 2026-07-25: imfile: fix delay.message microsecond conversion
• 2026-07-24: diskqueue: reject symlinked persisted segments
• 2026-06-23: omfile: control symlink following
• 2026-07-25: mmnormalize: make HUP reload worker-safe
• 2026-07-24: docs(agents): add Cursor Cloud environment setup notes
• 2026-07-22: imbeats: harden Lumberjack input resource handling
• 2026-07-23: stringbuf: harden empty string replacement
• 2026-07-20: imptcp: guard regex framing match at line start (CVE-2026-19654 bsc#1271910)
• 2026-07-21: rainerscript: free cnfstmtNewAct nvlst once, at the done: label
• 2026-07-21: queue: preserve DA child work during shutdown
• 2026-07-21: imtcp: release completed zlib decoder state
• 2026-07-09: doc: clarify JSON array rendering
• 2026-07-21: Potential fixes for 5 code quality findings (#7397)
• 2026-07-20: ratelimit: optimize port-based per-source keys
• 2026-07-20: imtcp: make zstd window budget configurable
• 2026-07-19: imtcp: use snake case for zstd window tracking
• 2026-07-17: imtcp: bound aggregate zstd decoder window memory
• 2026-07-20: statsobj: guard Prometheus escape writes
• 2026-07-18: config: do not instantiate actions disabled via config.enabled="off"
• 2026-07-15: queue: document DA engine internals
• 2026-07-14: msg: enforce source-property helper contract
• 2026-07-10: ratelimit: remove per-source key policy hot lock
• 2026-07-08: ratelimit: speed source-key shortcuts
• 2026-07-15: queue: clarify DA transfer worker role
• 2026-07-18: compat_queue: add missing STAILQ_FOREACH/STAILQ_NEXT fallback
• 2026-07-18: rainerscript: warn on constant AND/OR operand at parse time
• 2026-07-18: configure: include <stddef.h> in the STAILQ detection test
• 2026-07-17: mmnormalize: share Turbo CEE root path check
• 2026-07-17: mmnormalize: fall back after Turbo materialization failure
• 2026-07-17: mmnormalize: preserve turbo results across message boundaries
• 2026-07-17: benchmarks: harden comparison and helper inputs
• 2026-07-16: segdisk: optimize CRC accounting and add benchmarks
• 2026-07-15: imjournal: stop invalidation reopen…

This update for rsyslog fixes the following issues:

• imdtls permitted-peer authorization bypass (bsc#1281628).

Changes for rsyslog:

• Upgrade to version 8.2608.0 (bsc#1257604)

It was discovered that rsyslog incorrectly calculated buffer sizes when replacing strings. A remote attacker could possibly use this issue to cause rsyslog to crash, resulting in a denial of service.