# CVE-2026-55556: Rsyslog imhttp heap buffer overflow in Basic Authentication parsing

Source: https://junglewise.ai/threats/cve-2026-55556-rsyslog-is-a-rocket-fast-system-for-log-processing-from-8-2110-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-55556 · Severity: info · Published 2026-09-18

Rsyslog's imhttp module handles incoming log data via HTTP with optional Basic Authentication. An unauthenticated attacker sending a malformed HTTP Basic Authorization header can crash the rsyslog process, disrupting log collection. This affects only deployments that explicitly load and configure the imhttp module with Basic Authentication enabled.

Technologies: [Rsyslog](https://junglewise.ai/threats/technologies/rsyslog). Vendors: [Rsyslog](https://junglewise.ai/threats/vendors/rsyslog).

## Quick answers

**Is CVE-2026-55556 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55556 being exploited in the wild.

**How severe is CVE-2026-55556?** Informational severity, published 18 September 2026.

**Which products and versions are affected?** Rsyslog 8.2110.0 to 8.2603.0.

**Is there a fix for CVE-2026-55556?** A patch was published on 2026-09-18: Fixed in version 8.2604.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55556 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-55556?** Check whether you run Rsyslog at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The imhttp module's parse_auth_header function allocates a zero-byte heap buffer when an HTTP Basic Authorization credential exceeds its fixed-size work buffer, then passes the invalid pointer to apr_base64_decode for decoding. This allows heap memory corruption before credential validation. The vulnerability is reachable by unauthenticated remote attackers over the network if imhttp with Basic Authentication is configured; current impact is denial of service via process crash.

## Affected products

- rsyslog rsyslog 8.2110.0 to 8.2603.0

## Timeline

- 2026-09-18: disclosed
- 2026-09-18: patched: Fixed in version 8.2604.0

## References

- [https://github.com/rsyslog/rsyslog/commit/acde2ba25ea33816694b787859f4a727a247b6d6](https://github.com/rsyslog/rsyslog/commit/acde2ba25ea33816694b787859f4a727a247b6d6)
- [https://github.com/rsyslog/rsyslog/pull/6722](https://github.com/rsyslog/rsyslog/pull/6722)

## Related threats

- [rsyslog omfile dynaFile path traversal](https://junglewise.ai/threats/cve-2026-92709-rsyslog-is-a-rocket-fast-system-for-log-processing-from-versions)
- [rsyslog heap buffer overflow in RainerScript replace function](https://junglewise.ai/threats/cve-2026-78002-rsyslog-heap-buffer-overflow-in-rainerscript-replace-function)
- [rsyslog denial of service in imptcp module](https://junglewise.ai/threats/cve-2026-19654-rsyslog-denial-of-service-in-imptcp-module)