Executive brief
rsyslog is a critical system logging service used across enterprise infrastructure to collect, filter, and forward log messages. An unauthenticated attacker can trigger a heap buffer overflow by sending specially crafted syslog messages, causing the rsyslog daemon to crash and resulting in loss of logging functionality. This denial-of-service attack requires no authentication and can be exploited over the network, potentially blinding an organization to security events and operational issues.
Technical details
The vulnerability is a heap buffer overflow in the RainerScript `replace()` function, triggered by incorrect buffer size calculation during string replacement operations. An unauthenticated remote attacker can exploit this by sending specially crafted syslog messages over the network to a system running vulnerable rsyslog. The flaw leads to memory corruption that crashes the rsyslog daemon, resulting in denial of service. The attack vector is network-based with no authentication requirement, though no active exploitation in the wild has been reported. Patches addressing the buffer size calculation are expected from the rsyslog project.
Affected products
- rsyslog rsyslog
Timeline
- 2026-08-27: disclosed