rootpwn

high · CVSS v3 7.5 · CVSS v4 8.2

CVE-2026-55556

Rsyslog versions 8.2110.0 through 8.2604.0 contain a heap-based memory corruption vulnerability in the optional imhttp module. An unauthenti

Overview

Rsyslog versions 8.2110.0 through 8.2604.0 contain a heap-based memory corruption vulnerability in the optional imhttp module. An unauthenticated remote attacker can trigger this flaw by sending an oversized HTTP Basic Authorization header to an affected endpoint. This causes incorrect buffer allocation and adjacent memory overwrite, resulting in a denial of service.

Description

Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parse_auth_header function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc(0, len) when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes that pointer to apr_base64_decode. An unauthenticated remote attacker can send an oversized encoded credential to an imhttp endpoint configured for Basic Authentication, causing decoded data to overwrite adjacent heap memory before credential validation. Deployments that do not install, load, and use imhttp with Basic Authentication are not affected. The demonstrated impact is a process crash that interrupts log collection, and code execution has not been demonstrated. This issue is fixed in version 8.2604.0.

Impact

The vulnerability primarily impacts system availability by causing the Rsyslog process to crash, thereby interrupting log collection and forwarding services. Integrity and confidentiality could theoretically be affected through memory corruption, although only a process crash has been demonstrated. Unauthenticated remote attackers targeting Rsyslog instances utilizing the imhttp module with Basic Authentication are affected.

Remediation

Upgrade Rsyslog to version 8.2604.0 or later where the buffer allocation flaw is resolved. As a temporary mitigation, disable the imhttp module or remove HTTP Basic Authentication configurations if they are not strictly required for log ingestion.

Risk context

The vulnerability carries a CVSS v4 score of 8.2 and a CVSS v3 score of 7.5, classifying it as high severity. However, risk is mitigated in environments that do not load the optional imhttp module or do not use HTTP Basic Authentication. EPSS data is not currently available for this identifier.

Affected products

  • Rsyslog imhttp module

Scores

Severity
high
CVSS v2
7.5
CVSS v3
7.5
CVSS v4
8.2
EPSS
—

rsyslog heap-corruption buffer-overflow denial-of-service log-management high-severity

← All CVEs

Related CVEs

high

CVE-2026-93455

django-page-cms through version 2.0.13 contains an authorization bypass vulnerability in its admin helper views. The flaw allows low-privilege staff accounts to read unpublished drafts, page listings, and stored media paths without proper permission validation. This matters because it exposes sensitive organizational content to internal users who should not have access.

View analysis

high

CVE-2026-52727

The lxc-ci project inadvertently included a static pacman local-signing private key within Arch Linux container and virtual machine images built prior to May 28, 2026. This allows a malicious or compromised package mirror to issue cryptographically trusted packages to clients. Consequently, attackers can achieve arbitrary code execution as root on affected systems.

View analysis

high

CVE-2026-46655

A local integer overflow vulnerability exists in the virtio-win Viosock driver for Windows guests running on QEMU and KVM. A low-privilege local user can supply specially crafted inputs via IOCTL_SELECT to cause kernel heap memory corruption. This issue matters because it enables local privilege escalation within the guest operating system.

View analysis

high

CVE-2026-58197

ToolHive CLI and Studio before versions 0.30.1 and 0.38.0 run local Model Context Protocol server containers without proper network isolation. This allows unauthenticated access to host-local services, sibling MCP proxies, and the control plane via the Docker gateway. Compromised containers can exploit this lack of segmentation to expose sensitive data, alter workloads, and disrupt services.

View analysis