The vulnerability is a heap buffer overflow in rsyslog's imhttp plugin, triggered when an HTTP Basic Authorization header exceeds a predefined work buffer. The parse_auth_header function incorrectly allocates a zero‑byte heap buffer with calloc(0,len) and then feeds that pointer to apr_base64_decode, causing decoded data to overwrite adjacent heap memory. The primary observed effect is an unchecked memory corruption that results in a process crash, interrupting log collection. While arbitrary code execution has not yet been demonstrated, the nature of the overflow could permit it under suitable circumstances.

Affected installations are rsyslog versions 8.2110.0 through 8.2604.0 that enable the optional imhttp module with Basic Authentication. Versions prior to 8.2110.0 are not affected, nor are deployments that do not load or use the imhttp plugin with Basic Authentication. The advisory specifies that the issue was fixed in release 8.2604.0.

The vulnerability has a CVSS score of 8.2, indicating high severity. The EPSS score is not published, and the issue is not listed in CISA's KEV catalog. Exploitation requires an unauthenticated remote attacker to send an oversized Base64‑encoded credential to an imhttp endpoint configured for Basic Authentication. Because the flaw corrupts heap memory, a determined attacker could potentially achieve arbitrary code execution, but the current public evidence shows only denial‑of‑service. Consequently, the risk is high and timely action is warranted.