CVE-2026-55556

HighCVSS 8.2/10Last modified Sep 24, 2026

Description

Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parse_auth_header function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc(0, len) when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes that pointer to apr_base64_decode. An unauthenticated remote attacker can send an oversized encoded credential to an imhttp endpoint configured for Basic Authentication, causing decoded data to overwrite adjacent heap memory before credential validation. Deployments that do not install, load, and use imhttp with Basic Authentication are not affected. The demonstrated impact is a process crash that interrupts log collection, and code execution has not been demonstrated. This issue is fixed in version 8.2604.0.

Metrics

CVSS 4.0 8.2/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-122

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
rsyslog	rsyslog	>= 8.2110.0, < 8.2604.0

References

Timeline

Published: Sep 18, 2026
Last modified: Sep 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-555578.6browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2, browser_download writes a fetched respo CVE-2026-555585.9aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib/protocol.py consume CVE-2026-555599.8Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instanc CVE-2026-55566.3A security vulnerability has been detected in badlogic pi-mono up to 0.58.4. This vulnerability affects the function discoverAndLoadExtensio CVE-2026-555629.0Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htd CVE-2026-555638.9Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/pr_integration_tests.yml uses pull_re CVE-2026-555647.1FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c c CVE-2026-555659.9Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/o CVE-2026-555664.3Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-CVE-2026-555677.8BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not lock and validate a CVE-2026-555685.9Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in certain configurations, traffic expected to be protected by TLS on the hop to t CVE-2026-555696.6aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile metho