Description

A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-12T21:17:38.517Z",
  "pubdate": "2026-08-12T21:17:38.517Z",
  "executiveSummary": "An availability vulnerability exists within the optional imptcp module of rsyslogd, allowing an unauthenticated remote peer to cause a daemon crash.\nThe vulnerability is triggered by a crafted input sequence during oversize-frame recovery, which results in an invalid internal message length calculation and subsequent termination of the rsyslogd service.\nThe affected product is rsyslogd, specifically when utilizing the optional imptcp module. Standard configurations utilizing imtcp and the default imptcp framing modes are not affected.\nThe risk implication is a denial of service (DoS) affecting centralized logging infrastructure, potentially impairing security monitoring and event tracking capabilities.\nAn attacker must possess network access to the target listening port of the optional imptcp module, but no authentication, privileges, or prior system access are required.\nThere is no identified impact on confidentiality or integrity, and the vulnerability does not allow for privilege escalation or remote code execution.",
  "technicalDetails": "The vulnerability resides in the optional imptcp module of rsyslogd, specifically within the framing and buffer management logic handling incoming TCP syslog streams.\nThe root cause is an improper handling of message length calculations during the oversize-frame recovery state. When an incoming frame exceeds predefined size limits, the recovery mechanism processes a crafted input sequence in a manner that computes an invalid internal message length.\nExploitation requires network exposure to the port bound by the optional imptcp module. The attacker does not require authentication or elevated privileges, as the listener accepts unauthenticated remote connections.\nThe attack flow proceeds as follows: 1. The remote attacker establishes a TCP connection to the rsyslogd instance running the vulnerable imptcp module. 2. The attacker transmits a specially crafted input sequence designed to trigger an oversize-frame condition. 3. Upon encountering the oversize frame, the module initiates its error recovery routine. 4. Due to flawed logic in the recovery state, the internal message length is calculated incorrectly. 5. The invalid length value triggers a fatal error or assertion failure, forcing the rsyslogd process to terminate immediately, resulting in a denial of service.\nPayload behavior is limited to causing process termination; no arbitrary code execution, memory disclosure, or data modification occurs.\nPost-exploitation impact is constrained exclusively to service availability. The crash halts log collection until the service is manually or automatically restarted by a process supervisor."
}