Description
A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.
Published: 2026-08-27
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Workaround
AI Analysis

Impact

A flaw in rsyslog allows an unauthenticated remote attacker to trigger a heap buffer overflow in the RainerScript replace() function by sending specially crafted syslog messages. The buffer size calculation is incorrect during string replacement, causing memory corruption that results in a denial of service on the affected system. No escalation of privileges or code execution is stated, and the impact is limited to service disruption.

Affected Systems

Red Hat Enterprise Linux 6, 7, 8, 9 and 10 are all affected by this vulnerability. No specific subversions are listed, indicating that any installation running rsyslog on these operating systems is vulnerable.

Risk and Exploitability

The CVSS score is 7.5, indicating high severity. EPSS data is unavailable and the vulnerability is not listed in CISA KEV, suggesting limited publicly known exploitation. The likely attack vector is remote delivery of crafted syslog traffic over UDP or TCP to the standard rsyslog service port 514, leading to a DoS but not to remote code execution.

Generated by OpenCVE AI on August 27, 2026 at 17:37 UTC.

Remediation

Vendor Workaround

To mitigate this vulnerability, restrict network access to the rsyslog service to only trusted hosts. This can be achieved by configuring firewall rules to limit incoming connections to UDP and TCP port 514. Alternatively, if remote syslog reception is not required, disable the `imudp` and `imtcp` modules in the `/etc/rsyslog.conf` configuration file. After modifying the rsyslog configuration or firewall rules, the rsyslog service or firewall service must be restarted for the changes to take effect.

OpenCVE Recommended Actions

  • Restrict network access to the rsyslog service by configuring firewall rules to limit incoming connections to trusted hosts for both UDP and TCP port 514.
  • If remote syslog reception is not required, disable the imudp and imtcp modules in the /etc/rsyslog.conf configuration file.
  • After making these changes, restart the rsyslog service (or the firewall service if network rules were updated) to apply the new configuration.

Generated by OpenCVE AI on August 27, 2026 at 17:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Rsyslog
Rsyslog rsyslog
Vendors & Products Rsyslog
Rsyslog rsyslog

Sat, 29 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
References

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

threat_severity

Important

Thu, 27 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
Description A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.
Title Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-131
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Redhat Enterprise Linux
Rsyslog Rsyslog
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-04T09:05:29.096Z

Reserved: 2026-08-21T19:35:37.617Z

Link: CVE-2026-78002

cve-icon Vulnrichment

Updated: 2026-08-29T22:06:44.190Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-27T17:20:29.367

Modified: 2026-09-04T09:17:11.097

Link: CVE-2026-78002

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-26T00:00:00Z

Links: CVE-2026-78002 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-01T14:23:00Z

Weaknesses
  • CWE-131

    Incorrect Calculation of Buffer Size