Skip to content
Fencer Vulns
high 8.1

CVE-2026-61548 json

Rsyslog: mmpstrucdata stack buffer overflow with oversized RFC5424 structured data

published 2026-09-18 51 d ago modified 2026-09-24 45 d ago also EUVD-2026-83185

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits
0
none known

Summary

Rsyslog is a rocket-fast system for log processing. From 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseSD_PARAM function in plugins/mmpstrucdata/mmpstrucdata.c stores RFC5424 parameter values in a fixed pVal[32 * 1024] stack buffer and calls parsePARAM_VALUE without supplying the destination size. A remote unauthenticated attacker whose crafted RFC5424 message reaches an action using mmpstrucdata can provide a structured-data parameter larger than that buffer when MaxMessageSize permits it, causing an attacker-controlled stack overwrite. Deployments that do not install and use the plugin, or whose effective message-size limit remains below the required threshold, are not affected by this issue. The demonstrated impact is a crash and interruption of log collection; code execution is not demonstrated. This issue is fixed in version 8.2606.0.

Patch / fix

  • rsyslog Debian 13 8.2504.0-1+deb13u2
  • rsyslog Debian 14 8.2606.0-4

debian advisories DEBIAN-CVE-2026-61548

  • rsyslog Ubuntu 22.04 LTS 8.2112.0-2ubuntu2.4
  • rsyslog Ubuntu 24.04 LTS 8.2312.0-3ubuntu9.3
  • rsyslog Ubuntu 26.04 LTS 8.2512.0-1ubuntu4.1

ubuntu advisories UBUNTU-CVE-2026-61548

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rsyslog SLE Module for Server Applications 15 SP7, SLE Module for Package Hub 15 SP7, SLE Module for Basesystem 15 SP7 8.2608.0-150700.3.24.1
  • rsyslog SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 8.2306.0-150400.5.40.1
  • rsyslog SLES 16.0, SLES for SAP applications 16.0 8.2502.0-160000.4.1
  • rsyslog SLE Module for Server Applications 15 SP7, SLE Module for Package Hub 15 SP7, SLE Module for Basesystem 15 SP7 8.2406.0-150700.3.7.1
  • rsyslog SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 8.2106.0-8.22.1
  • rsyslog SLES for SAP 15 SP6, SLES 15 SP6-LTSS 8.2406.0-150600.12.16.1

suse advisories SUSE-SU-2026:4611-1SUSE-SU-2026:3518-1SUSE-SU-2026:23122-1SUSE-SU-2026:23145-1SUSE-SU-2026:3498-1SUSE-SU-2026:3478-1

  • rsyslog openSUSE Leap 16.0 8.2608.0-160000.1.1
  • rsyslog openSUSE Leap 16.0 8.2502.0-160000.4.1
  • rsyslog openSUSE Tumbleweed 8.2606.0-1.1

opensuse advisories openSUSE-SU-2026:22184-1openSUSE-SU-2026:21535-1openSUSE-SU-2026:11407-1

  • rsyslog Alpine 3.24 8.2608.0-r0

alpine advisories ALPINE-CVE-2026-61548

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-61548 updated cvss 7.5

rsyslog: Rsyslog: Denial of Service due to stack buffer overflow in mmpstrucdata plugin

  • Red Hat Enterprise Linux 6 rsyslog, rsyslog7, rsyslog-relp, rsyslog-snmp, rsyslog-mysql, rsyslog-pgsql, +9 more Red Hat Enterprise Linux 7 rsyslog, rsyslog-relp, rsyslog-snmp, rsyslog-kafka, rsyslog-mysql, rsyslog-pgsql, +11 more Red Hat Enterprise Linux 8 rsyslog, rsyslog-relp, rsyslog-snmp, rsyslog-kafka, rsyslog-mysql, rsyslog-pgsql, +13 more Red Hat Enterprise Linux 9 rsyslog, rsyslog-relp, rsyslog-snmp, rsyslog-kafka, rsyslog-mysql, rsyslog-pgsql, +14 more
    not affected: vulnerable code not present
  • Red Hat Enterprise Linux 10 rsyslog
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
51 d ago

Exploit prediction

0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • rsyslog rsyslog

Classification

Weakness
  • CWE-121 Stack-based Buffer Overflow

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.