Executive brief
rsyslog is a widely-used system logging daemon that collects and processes log messages from applications and the operating system. An unauthenticated remote attacker can send a specially crafted sequence of network packets to the optional imptcp module that causes rsyslogd to crash, disrupting logging services and potentially masking malicious activity on affected systems.
Technical details
This vulnerability is a denial-of-service (DoS) flaw in rsyslog's optional imptcp (improved TCP input) module. The vulnerability stems from improper handling of oversize-frame recovery, where a crafted input sequence can trigger an invalid internal message length calculation. An unauthenticated remote peer can exploit this via network connectivity to the imptcp listener to cause rsyslogd to terminate abnormally. The vulnerability does not affect the default imptcp framing modes, imtcp module, or allow for code execution, privilege escalation, or data compromise. The fix/patch status should be confirmed with the rsyslog maintainers.
Affected products
- rsyslog rsyslog
Timeline
- 2026-08-12: disclosed