{"id":"CVE-2026-19654","title":"A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module","summary":"A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confide…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-125"],"vendor":"rsyslog","product":"rsyslog","affected":["rsyslog >= 8.36.0, < 8.2608.0","enterprise_linux = 6.0","enterprise_linux = 7.0","enterprise_linux = 8.0","enterprise_linux = 9.0","enterprise_linux = 10.0"],"patched":["rsyslog 8.2608.0"],"published":"2026-08-12","updated":"2026-09-15","sourceUpdated":"2026-09-15T19:17:17.583","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19654","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:66405","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:67583","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:67584","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-19654","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2502868","label":"secalert@redhat.com"},{"url":"https://github.com/rsyslog/rsyslog/security/advisories/GHSA-cj5r-wh2m-7w29","label":"secalert@redhat.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19654.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19654"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19654"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-08-13T12:58:34.167792Z"},"epss":0.00455,"epssPercentile":0.38705,"ingestedAt":"2026-09-10T14:51:56.267Z","slug":"CVE-2026-19654","body":"## Overview\n\nA unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.\n\n## Affected\n\n- `rsyslog >= 8.36.0, < 8.2608.0`\n- `enterprise_linux = 6.0`\n- `enterprise_linux = 7.0`\n- `enterprise_linux = 8.0`\n- `enterprise_linux = 9.0`\n- `enterprise_linux = 10.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `rsyslog 8.2608.0`\n\n## Vendor advisories\n\n- **RHSA-2026:66405** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66405)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 8 · no fix planned: Red Hat Enterprise Linux 8 · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19654.json)\n- **RHSA-2026:67584** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67584)\n- **RHSA-2026:67583** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67583)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}