Skip to content

GHSA-cj5r-wh2m-7w29

CVE Information

Summary

This issue is not active in default rsyslog installations. It affects only deployments that explicitly load the optional imptcp input module and configure an imptcp listener with the non-default framing.delimiter.regex setting.

An unauthenticated remote client that can establish a TCP connection to such a listener can send crafted input that terminates the rsyslogd process, resulting in a denial of service.

No confidentiality or integrity impact has been demonstrated.

Affected configurations

A deployment is affected only if all of the following apply:

  1. The optional imptcp module is installed and explicitly loaded:
module(load="imptcp")
  1. An imptcp input is configured with framing.delimiter.regex, for example:
input(
    type="imptcp"
    port="514"
    framing.delimiter.regex="^<[0-9]{1,3}>..."
)
  1. An attacker can establish a TCP connection to that listener.

Default imptcp framing, including octet-counted and newline-delimited framing, is not affected. The imtcp module is also not affected by this issue.

Mitigation

Upgrade to the rsyslog daily stable build published on 2026-07-23 (CEST) or later.

Until an upgrade is available, affected deployments can mitigate the issue by one of the following:

  • Replace the affected imptcp listener with an equivalent imtcp listener
  • Remove framing.delimiter.regex from affected imptcp inputs and use standard framing.
  • Disable the affected imptcp listener or unload imptcp if it is not required.
  • Restrict network access to the listener to trusted senders.

Affected versions

The vulnerable regex-framing implementation was introduced in rsyslog v8.36.0.

Scheduled stable releases from v8.36.0 through v8.2606.0 are affected when used with the configuration described above. Daily stable builds published before 2026-07-23 (CEST) are also affected.

The fix is included in daily stable builds published on or after 2026-07-23 (CEST) and will be included in the next scheduled stable release.

Credit

Thanks to Raphael Eikenberg for reporting this issue.