Description
A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.
Affected products
rsyslog: rsyslog; redhat: enterprise linux
References10
- github.com/rsyslog/rsyslog/security/advisories/GHSA-cj5r-wh2m-7… Vendor Advisory
- access.redhat.com/errata/RHSA-2026:66405
- access.redhat.com/errata/RHSA-2026:67583
- access.redhat.com/errata/RHSA-2026:67584
- access.redhat.com/errata/RHSA-2026:71603
- access.redhat.com/errata/RHSA-2026:80817
- access.redhat.com/errata/RHSA-2026:84571
- access.redhat.com/errata/RHSA-2026:84576
- access.redhat.com/errata/RHSA-2026:86124
- access.redhat.com/errata/RHSA-2026:87408
Metrics
- CVSS 3.1
-
7.5
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS — exploit probability
- 1% percentile: 56 · as of 12 November 2026
- CWE
- CWE-125
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.