Vulnerability · Published Sep 18, 2026 · Assigned by GitHub_M
CVE-2026-55556Rsyslog: Heap buffer overflow in imhttp plugin Basic Authentication handling
High 8.2
In plain English
A high-severity heap buffer overflow in rsyslog from rsyslog. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parse_auth_header function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc(0, len) when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes that pointer to apr_base64_decode. An unauthenticated remote attacker can send an oversized encoded credential to an imhttp endpoint configured for Basic Authentication, causing decoded data to overwrite adjacent heap memory before credential validation. Deployments that do not install, load, and use imhttp with Basic Authentication are not affected. The demonstrated impact is a process crash that interrupts log collection, and code execution has not been demonstrated. This issue is fixed in version 8.2604.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | rsyslog | 8.2608.0-r0 | ALPINE-CVE-2026-55556 |
| Debian:12 | rsyslog | no fix listed | DEBIAN-CVE-2026-55556 |
| Debian:13 | rsyslog | no fix listed | DEBIAN-CVE-2026-55556 |
| Debian:14 | rsyslog | 8.2604.0-1 | DEBIAN-CVE-2026-55556 |
| Ubuntu:22.04:LTS | rsyslog | no fix listed | UBUNTU-CVE-2026-55556 |
| Ubuntu:24.04:LTS | rsyslog | no fix listed | UBUNTU-CVE-2026-55556 |
| Ubuntu:25.10 | rsyslog | no fix listed | UBUNTU-CVE-2026-55556 |
| Ubuntu:26.04:LTS | rsyslog | no fix listed | UBUNTU-CVE-2026-55556 |
Affected products (as reported)
Weakness: CWE-122 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/rsyslog/rsyslog/security/advisories/GHSA-947w-69ph-mc2r x_refsource_CONFIRM
- https://github.com/rsyslog/rsyslog/pull/6722 x_refsource_MISC
- https://github.com/rsyslog/rsyslog/commit/acde2ba25ea33816694b787859f4a727a247b6d6 x_refsource_MISC
- https://github.com/rsyslog/rsyslog/releases/tag/v8.2604.0 x_refsource_MISC
- http://www.openwall.com/lists/oss-security/2026/06/23/4