Skip to content
Fencer Vulns
high 7.5

CVE-2026-78002 json

Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function

published 2026-08-27 2 mo ago modified 2026-11-09 8 h ago also EUVD-2026-67085

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 64%
public exploits
0
none known

Summary

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:8.2510.0-5.el10_2.2
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:8.2412.0-1.el10_0.2
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:8.24.0-57.el7_9.4
  • Red Hat Red Hat Enterprise Linux 8 0:8.2102.0-15.el8_10.3
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:8.1911.0-7.el8_4.5
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:8.1911.0-7.el8_4.5
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:8.2102.0-7.el8_6.2
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:8.2102.0-7.el8_6.2
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:8.2102.0-13.el8_8.1
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:8.2102.0-13.el8_8.1
  • Red Hat Red Hat Enterprise Linux 9 0:8.2510.0-2.el9_8.2
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:8.2102.0-113.el9_2.3
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:8.2310.0-4.el9_4.2
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:8.2412.0-1.el9_6.2
  • Red Hat Red Hat Update Infrastructure 5 1790241900
  • rsyslog Debian 13 8.2504.0-1+deb13u2
  • rsyslog Debian 14 8.2608.0-4

debian advisories DEBIAN-CVE-2026-78002

  • rsyslog Ubuntu 22.04 LTS 8.2112.0-2ubuntu2.5
  • rsyslog Ubuntu 24.04 LTS 8.2312.0-3ubuntu9.4
  • rsyslog Ubuntu 26.04 LTS 8.2512.0-1ubuntu4.2
  • rsyslog Ubuntu Pro 16.04 LTS 8.16.0-1ubuntu3.1+esm3
  • rsyslog Ubuntu Pro 18.04 LTS 8.32.0-1ubuntu4.2+esm1
  • rsyslog Ubuntu Pro 20.04 LTS 8.2001.0-1ubuntu1.3+esm1

ubuntu advisories UBUNTU-CVE-2026-78002

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rsyslog RHEL 8 8.2102.0-15.el8_10.3
  • rsyslog RHEL 10.2 8.2510.0-5.el10_2.2
  • rsyslog-relp RHEL 10.2 8.2510.0-5.el10_2.2
  • rsyslog-snmp RHEL 10.2 8.2510.0-5.el10_2.2
  • rsyslog-kafka RHEL 10.2 8.2510.0-5.el10_2.2
  • rsyslog-mysql RHEL 10.2 8.2510.0-5.el10_2.2
  • rsyslog-pgsql RHEL 10.2 8.2510.0-5.el10_2.2
  • rsyslog-crypto RHEL 10.2 8.2510.0-5.el10_2.2

red hat advisories RHSA-2026:84576RHSA-2026:81321RHSA-2026:80817RHSA-2026:69541RHSA-2026:69540

  • rsyslog SLE Module for Server Applications 15 SP7, SLE Module for Package Hub 15 SP7, SLE Module for Basesystem 15 SP7 8.2608.0-150700.3.24.1

suse advisories SUSE-SU-2026:4611-1

  • rsyslog openSUSE Leap 16.0 8.2608.0-160000.1.1

opensuse advisories openSUSE-SU-2026:22184-1

  • rsyslog AlmaLinux 8 8.2102.0-15.el8_10.3
  • rsyslog-relp AlmaLinux 8 8.2102.0-15.el8_10.3
  • rsyslog-snmp AlmaLinux 8 8.2102.0-15.el8_10.3
  • rsyslog-kafka AlmaLinux 8 8.2102.0-15.el8_10.3
  • rsyslog-mysql AlmaLinux 8 8.2102.0-15.el8_10.3
  • rsyslog-pgsql AlmaLinux 8 8.2102.0-15.el8_10.3
  • rsyslog-crypto AlmaLinux 8 8.2102.0-15.el8_10.3
  • rsyslog-gnutls AlmaLinux 8 8.2102.0-15.el8_10.3

almalinux advisories ALSA-2026:80817ALSA-2026:69540ALSA-2026:69541

  • rsyslog Rocky Linux 8 8.2102.0-15.el8_10.3
  • rsyslog Rocky Linux 9 8.2510.0-2.el9_8.2
  • rsyslog Rocky Linux 10 8.2510.0-5.el10_2.2

rocky linux advisories RLSA-2026:80817RLSA-2026:69540RLSA-2026:69541

  • rsyslog Alpine 3.24 8.2608.0-r0

alpine advisories ALPINE-CVE-2026-78002

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rsyslog Azure Linux 3.0 8.2308.0-7

azure linux advisories AZL-98400

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-78002 updated cvss 7.5

rsyslog: rsyslog: Denial of service via heap buffer overflow in RainerScript replace() function

  • Red Hat Enterprise Linux AppStream (v. 8) rsyslog 8.2102.0-15.el8_10.3
    fixed: vendor fix RHSA-2026:80817
  • Red Hat Enterprise Linux AppStream (v. 9) rsyslog 8.2510.0-2.el9_8.2, rsyslog-relp 8.2510.0-2.el9_8.2, rsyslog-snmp 8.2510.0-2.el9_8.2, rsyslog-kafka 8.2510.0-2.el9_8.2, rsyslog-mysql 8.2510.0-2.el9_8.2, rsyslog-pgsql 8.2510.0-2.el9_8.2, +14 more
    fixed: vendor fix RHSA-2026:69540
  • Red Hat Enterprise Linux AppStream (v. 10) rsyslog 8.2510.0-5.el10_2.2, rsyslog-relp 8.2510.0-5.el10_2.2, rsyslog-snmp 8.2510.0-5.el10_2.2, rsyslog-kafka 8.2510.0-5.el10_2.2, rsyslog-mysql 8.2510.0-5.el10_2.2, rsyslog-pgsql 8.2510.0-5.el10_2.2, +13 more
    fixed: vendor fix RHSA-2026:69541
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) rsyslog 8.1911.0-7.el8_4.5, rsyslog-relp 8.1911.0-7.el8_4.5, rsyslog-snmp 8.1911.0-7.el8_4.5, rsyslog-kafka 8.1911.0-7.el8_4.5, rsyslog-mysql 8.1911.0-7.el8_4.5, rsyslog-pgsql 8.1911.0-7.el8_4.5, +11 more
    fixed: vendor fix RHSA-2026:95573
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) rsyslog 8.2102.0-7.el8_6.2, rsyslog-relp 8.2102.0-7.el8_6.2, rsyslog-snmp 8.2102.0-7.el8_6.2, rsyslog-kafka 8.2102.0-7.el8_6.2, rsyslog-mysql 8.2102.0-7.el8_6.2, rsyslog-pgsql 8.2102.0-7.el8_6.2, +13 more
    fixed: vendor fix RHSA-2026:91582
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) rsyslog 8.2102.0-13.el8_8.1, rsyslog-relp 8.2102.0-13.el8_8.1, rsyslog-snmp 8.2102.0-13.el8_8.1, rsyslog-kafka 8.2102.0-13.el8_8.1, rsyslog-mysql 8.2102.0-13.el8_8.1, rsyslog-pgsql 8.2102.0-13.el8_8.1, +13 more
    fixed: vendor fix RHSA-2026:87408
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) rsyslog 8.2102.0-113.el9_2.3, rsyslog-relp 8.2102.0-113.el9_2.3, rsyslog-snmp 8.2102.0-113.el9_2.3, rsyslog-kafka 8.2102.0-113.el9_2.3, rsyslog-mysql 8.2102.0-113.el9_2.3, rsyslog-pgsql 8.2102.0-113.el9_2.3, +14 more
    fixed: vendor fix RHSA-2026:86124
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) rsyslog 8.2310.0-4.el9_4.2, rsyslog-relp 8.2310.0-4.el9_4.2, rsyslog-snmp 8.2310.0-4.el9_4.2, rsyslog-kafka 8.2310.0-4.el9_4.2, rsyslog-mysql 8.2310.0-4.el9_4.2, rsyslog-pgsql 8.2310.0-4.el9_4.2, +14 more
    fixed: vendor fix RHSA-2026:90349
show 8 more
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) rsyslog 8.2412.0-1.el10_0.2, rsyslog-relp 8.2412.0-1.el10_0.2, rsyslog-snmp 8.2412.0-1.el10_0.2, rsyslog-kafka 8.2412.0-1.el10_0.2, rsyslog-mysql 8.2412.0-1.el10_0.2, rsyslog-pgsql 8.2412.0-1.el10_0.2, +13 more
    fixed: vendor fix RHSA-2026:81321
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) rsyslog 8.2412.0-1.el9_6.2, rsyslog-relp 8.2412.0-1.el9_6.2, rsyslog-snmp 8.2412.0-1.el9_6.2, rsyslog-kafka 8.2412.0-1.el9_6.2, rsyslog-mysql 8.2412.0-1.el9_6.2, rsyslog-pgsql 8.2412.0-1.el9_6.2, +14 more
    fixed: vendor fix RHSA-2026:84576
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) rsyslog 8.1911.0-7.el8_4.5, rsyslog-relp 8.1911.0-7.el8_4.5, rsyslog-snmp 8.1911.0-7.el8_4.5, rsyslog-kafka 8.1911.0-7.el8_4.5, rsyslog-mysql 8.1911.0-7.el8_4.5, rsyslog-pgsql 8.1911.0-7.el8_4.5, +11 more
    fixed: vendor fix RHSA-2026:95573
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) rsyslog 8.2102.0-7.el8_6.2, rsyslog-relp 8.2102.0-7.el8_6.2, rsyslog-snmp 8.2102.0-7.el8_6.2, rsyslog-kafka 8.2102.0-7.el8_6.2, rsyslog-mysql 8.2102.0-7.el8_6.2, rsyslog-pgsql 8.2102.0-7.el8_6.2, +13 more
    fixed: vendor fix RHSA-2026:91582
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) rsyslog 8.2102.0-13.el8_8.1, rsyslog-relp 8.2102.0-13.el8_8.1, rsyslog-snmp 8.2102.0-13.el8_8.1, rsyslog-kafka 8.2102.0-13.el8_8.1, rsyslog-mysql 8.2102.0-13.el8_8.1, rsyslog-pgsql 8.2102.0-13.el8_8.1, +13 more
    fixed: vendor fix RHSA-2026:87408
  • Red Hat Enterprise Linux Server (v. 7 ELS) rsyslog 8.24.0-57.el7_9.4, rsyslog-relp 8.24.0-57.el7_9.4, rsyslog-kafka 8.24.0-57.el7_9.4, rsyslog-mysql 8.24.0-57.el7_9.4, rsyslog-pgsql 8.24.0-57.el7_9.4, rsyslog-gnutls 8.24.0-57.el7_9.4, +2 more Red Hat Enterprise Linux Server Optional (v. 7 ELS) rsyslog-snmp 8.24.0-57.el7_9.4, rsyslog-crypto 8.24.0-57.el7_9.4, rsyslog-libdbi 8.24.0-57.el7_9.4, rsyslog-mmaudit 8.24.0-57.el7_9.4, rsyslog-udpspoof 8.24.0-57.el7_9.4, rsyslog-mmjsonparse 8.24.0-57.el7_9.4, +4 more
    fixed: vendor fix RHSA-2026:96085
  • Red Hat Update Infrastructure 5 rhui5/haproxy-rhel9 1790241900
    fixed: vendor fix RHSA-2026:71603
  • Red Hat Enterprise Linux 6 rsyslog, rsyslog7, rsyslog-relp, rsyslog-snmp, rsyslog-mysql, rsyslog-pgsql, +9 more Red Hat Enterprise Linux AppStream (v. 8) rsyslog-relp 8.2102.0-15.el8_10.3, rsyslog-snmp 8.2102.0-15.el8_10.3, rsyslog-kafka 8.2102.0-15.el8_10.3, rsyslog-mysql 8.2102.0-15.el8_10.3, rsyslog-pgsql 8.2102.0-15.el8_10.3, rsyslog-crypto 8.2102.0-15.el8_10.3, +12 more Red Hat Enterprise Linux AppStream AUS (v.8.4) rsyslog-doc 8.1911.0-7.el8_4.5, rsyslog-udpspoof-debuginfo 8.1911.0-7.el8_4.5 Red Hat Enterprise Linux AppStream AUS (v.8.6) rsyslog-doc 8.2102.0-7.el8_6.2, rsyslog-udpspoof-debuginfo 8.2102.0-7.el8_6.2 Red Hat Enterprise Linux AppStream E4S (v.8.8) rsyslog-doc 8.2102.0-13.el8_8.1, rsyslog-kafka-debuginfo 8.2102.0-13.el8_8.1, rsyslog-gnutls-debuginfo 8.2102.0-13.el8_8.1, rsyslog-gssapi-debuginfo 8.2102.0-13.el8_8.1, rsyslog-mmaudit-debuginfo 8.2102.0-13.el8_8.1, rsyslog-mmfields-debuginfo 8.2102.0-13.el8_8.1, +1 more Red Hat Enterprise Linux AppStream E4S (v.9.2) rsyslog-doc 8.2102.0-113.el9_2.3, rsyslog-relp-debuginfo 8.2102.0-113.el9_2.3, rsyslog-snmp-debuginfo 8.2102.0-113.el9_2.3, rsyslog-kafka-debuginfo 8.2102.0-113.el9_2.3, rsyslog-mysql-debuginfo 8.2102.0-113.el9_2.3, rsyslog-pgsql-debuginfo 8.2102.0-113.el9_2.3, +12 more
    +8 more products
    Red Hat Enterprise Linux AppStream E4S (v.9.4) rsyslog-doc 8.2310.0-4.el9_4.2, rsyslog-relp-debuginfo 8.2310.0-4.el9_4.2, rsyslog-snmp-debuginfo 8.2310.0-4.el9_4.2, rsyslog-mysql-debuginfo 8.2310.0-4.el9_4.2, rsyslog-pgsql-debuginfo 8.2310.0-4.el9_4.2, rsyslog-mmaudit-debuginfo 8.2310.0-4.el9_4.2, +8 more Red Hat Enterprise Linux AppStream EUS (v. 10.0) rsyslog-debuginfo 8.2412.0-1.el10_0.2, rsyslog-relp-debuginfo 8.2412.0-1.el10_0.2, rsyslog-snmp-debuginfo 8.2412.0-1.el10_0.2, rsyslog-kafka-debuginfo 8.2412.0-1.el10_0.2, rsyslog-mysql-debuginfo 8.2412.0-1.el10_0.2, rsyslog-pgsql-debuginfo 8.2412.0-1.el10_0.2, +13 more Red Hat Enterprise Linux AppStream EUS (v.9.6) rsyslog-doc 8.2412.0-1.el9_6.2, rsyslog-relp-debuginfo 8.2412.0-1.el9_6.2, rsyslog-snmp-debuginfo 8.2412.0-1.el9_6.2, rsyslog-kafka-debuginfo 8.2412.0-1.el9_6.2, rsyslog-mysql-debuginfo 8.2412.0-1.el9_6.2, rsyslog-pgsql-debuginfo 8.2412.0-1.el9_6.2, +12 more Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) rsyslog-doc 8.1911.0-7.el8_4.5, rsyslog-udpspoof-debuginfo 8.1911.0-7.el8_4.5 Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) rsyslog-doc 8.2102.0-7.el8_6.2, rsyslog-udpspoof-debuginfo 8.2102.0-7.el8_6.2 Red Hat Enterprise Linux AppStream TUS (v.8.8) rsyslog-doc 8.2102.0-13.el8_8.1, rsyslog-kafka-debuginfo 8.2102.0-13.el8_8.1, rsyslog-gnutls-debuginfo 8.2102.0-13.el8_8.1, rsyslog-gssapi-debuginfo 8.2102.0-13.el8_8.1, rsyslog-mmaudit-debuginfo 8.2102.0-13.el8_8.1, rsyslog-mmfields-debuginfo 8.2102.0-13.el8_8.1, +1 more Red Hat Enterprise Linux Server Optional (v. 7 ELS) rsyslog-doc 8.24.0-57.el7_9.4 Red Hat Update Infrastructure 5 rhui5/cds-rhel9 1790241954, rhui5/rhua-rhel9 1790242004, rhui5/installer-rhel9 1790241922, rhui5/cds-kubernetes-rhel9 1790241897
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

1.06% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat Update Infrastructure 5
  • Red Hat Red Hat Enterprise Linux 6

Classification

Weakness
  • CWE-131 Incorrect Calculation of Buffer Size

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.