CVE-2026-61548
HighCVSS 8.1Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
In Rsyslog from 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseSD_PARAM function stores RFC5424 parameter values in a fixed pVal[32 * 1024] stack buffer and calls parsePARAM_VALUE without supplying the destination size. A remote unauthenticated attacker whose crafted RFC5424 message reaches an action using mmpstrucdata can provide a parameter larger than the buffer, causing an attacker-controlled stack overwrite. This is fixed in version 8.2606.0.
Risk Assessment
This can cause a process crash and interrupt log collection. The demonstrated impact is a crash; code execution has not been demonstrated, but the risk remains high.
Recommendation
Upgrade Rsyslog to version 8.2606.0 or later. If the mmpstrucdata plugin is not used, consider removing or disabling it.
Other vulnerabilities in Rsyslog
See all- CVE-2026-55556High
In Rsyslog from 8.2110.0 until 8.2604.0, the optional imhttp module's parse_auth_header function allocates a zero-byte heap buffer with calloc(0, len) when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes that pointer to apr_base64_decode. An unauthenticated remote attacker can send an oversized encoded credential to an imhttp endpoint configured for Basic Authentication, causing decoded data to overwrite adjacent heap memory before credential validation. This is fixed in version 8.2604.0.
- CVE-2026-78002High
A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.
- CVE-2026-19654High
An unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality, integrity, privilege escalation, or code execution impact has been identified.
Original NVD description (English source)
Rsyslog is a rocket-fast system for log processing. From 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseSD_PARAM function in plugins/mmpstrucdata/mmpstrucdata.c stores RFC5424 parameter values in a fixed pVal[32 * 1024] stack buffer and calls parsePARAM_VALUE without supplying the destination size. A remote unauthenticated attacker whose crafted RFC5424 message reaches an action using mmpstrucdata can provide a structured-data parameter larger than that buffer when MaxMessageSize permits it, causing an attacker-controlled stack overwrite. Deployments that do not install and use the plugin, or whose effective message-size limit remains below the required threshold, are not affected by this issue. The demonstrated impact is a crash and interruption of log collection; code execution is not demonstrated. This issue is fixed in version 8.2606.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS