Vulnerability · Published Sep 18, 2026 · Assigned by GitHub_M
CVE-2026-61548Rsyslog: mmpstrucdata stack buffer overflow with oversized RFC5424 structured data
High 8.1
In plain English
A high-severity stack buffer overflow in rsyslog from rsyslog. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Rsyslog is a rocket-fast system for log processing. From 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseSD_PARAM function in plugins/mmpstrucdata/mmpstrucdata.c stores RFC5424 parameter values in a fixed pVal[32 * 1024] stack buffer and calls parsePARAM_VALUE without supplying the destination size. A remote unauthenticated attacker whose crafted RFC5424 message reaches an action using mmpstrucdata can provide a structured-data parameter larger than that buffer when MaxMessageSize permits it, causing an attacker-controlled stack overwrite. Deployments that do not install and use the plugin, or whose effective message-size limit remains below the required threshold, are not affected by this issue. The demonstrated impact is a crash and interruption of log collection; code execution is not demonstrated. This issue is fixed in version 8.2606.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | rsyslog | 8.2608.0-r0 | ALPINE-CVE-2026-61548 |
| Debian:12 | rsyslog | no fix listed | DEBIAN-CVE-2026-61548 |
| Debian:13 | rsyslog | 8.2504.0-1+deb13u2 | DEBIAN-CVE-2026-61548 |
| Debian:14 | rsyslog | 8.2606.0-4 | DEBIAN-CVE-2026-61548 |
| Ubuntu:22.04:LTS | rsyslog | 8.2112.0-2ubuntu2.4 | UBUNTU-CVE-2026-61548 |
| Ubuntu:22.04:LTS | rsyslog | 8.2112.0-2ubuntu2.4 | USN-8598-1 |
| Ubuntu:24.04:LTS | rsyslog | 8.2312.0-3ubuntu9.3 | USN-8598-1 |
| Ubuntu:24.04:LTS | rsyslog | 8.2312.0-3ubuntu9.3 | UBUNTU-CVE-2026-61548 |
| Ubuntu:26.04:LTS | rsyslog | 8.2512.0-1ubuntu4.1 | USN-8598-1 |
| Ubuntu:26.04:LTS | rsyslog | 8.2512.0-1ubuntu4.1 | UBUNTU-CVE-2026-61548 |
Affected products (as reported)
Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/rsyslog/rsyslog/security/advisories/GHSA-8qmr-c66f-g368 x_refsource_CONFIRM
- https://github.com/rsyslog/rsyslog/pull/6991 x_refsource_MISC
- https://github.com/rsyslog/rsyslog/commit/bcda60a3692efdf0c8e44102528f5a0ebe0dec6d x_refsource_MISC
- https://github.com/rsyslog/rsyslog/releases/tag/v8.2606.0 x_refsource_MISC
- http://www.openwall.com/lists/oss-security/2026/07/20/1