CVE-2026-19654

Published: Aug 12, 2026Modified: Aug 27, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.

Affected (6)

Products: Redhat: Enterprise Linux · Rsyslog: Rsyslog

1 product

1 product

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 10.0
Redhat Enterprise Linux	Version 6.0
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux	Version 9.0
Rsyslog Rsyslog	From 8.36.0 to 8.2608.0

Related CWEs

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (3)

https://access.redhat.com/security/cve/CVE-2026-19654

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2502868

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://github.com/rsyslog/rsyslog/security/advisories/GHSA-cj5r-wh2m-7w29

Source: secalert@redhat.com

Vendor Advisory

Timeline

No history available yet.