CVE-2026-19654: 
rsyslog vulnerability analysis and mitigation

CVE-2026-19654 is a denial-of-service vulnerability in the optional imptcp input module of rsyslogd that allows an unauthenticated remote attacker to crash the logging daemon. A crafted input sequence sent during oversize-frame recovery causes an invalid internal message length calculation, terminating the rsyslogd process. The flaw affects rsyslog versions 8.36.0 through 8.2606.0 (and daily stable builds before 2026-07-23), as well as Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10 that ship the affected rsyslog package. It was reported by Raphael Eikenberg, disclosed via GitHub Security Advisory on July 22, 2026, and published to NVD on August 12, 2026. The CVSS v3.1 base score is 7.5 (High) (Red Hat Advisory, GitHub Advisory).

The root cause is an out-of-bounds read (CWE-125) in the regex-based framing logic of the imptcp module, introduced in rsyslog v8.36.0. When an oversized frame triggers the recovery path, a crafted input sequence causes the module to compute an invalid internal message length, leading to process termination. Exploitation requires three specific preconditions: (1) the imptcp module is explicitly loaded (module(load="imptcp")), (2) an imptcp listener is configured with the non-default framing.delimiter.regex mode, and (3) the attacker can establish a TCP connection to that listener. The standard imtcp module and default imptcp framing modes (octet-counted and newline-delimited) are not affected (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation causes rsyslogd to terminate, rendering the system logging service unavailable — a pure availability impact with no confidentiality or integrity consequences, and no privilege escalation or code execution identified. Loss of the logging daemon can blind security monitoring, incident response, and audit trails, potentially allowing other malicious activity to go undetected. The impact is limited to the scope of the affected rsyslogd instance and does not directly enable lateral movement (Red Hat Advisory, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.40%, indicating a low probability of exploitation in the near term. The vulnerability is automatable (no user interaction required) but is constrained by the non-default configuration prerequisites, significantly limiting the exposed attack surface. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat Advisory).

1. Reconnaissance: Identify hosts running rsyslogd with the imptcp module loaded and a listener configured with framing.delimiter.regex. This can be done via network scanning (e.g., Shodan, Censys, or nmap) targeting common syslog TCP ports (514, or custom ports).
2. Establish TCP connection: Connect to the target imptcp listener port using a standard TCP client or custom tool.
3. Send oversized frame: Transmit a crafted oversized syslog frame designed to trigger the oversize-frame recovery code path in the regex framing logic.
4. Inject malformed sequence: Within or following the oversized frame, send a specific crafted byte sequence that causes the internal message length calculation to produce an invalid value during recovery.
5. Achieve denial of service: The invalid message length causes rsyslogd to crash and terminate, making the logging service unavailable (GitHub Advisory, Red Hat Bugzilla).

• Network: Unexpected or repeated TCP connections to the rsyslogd listener port (default 514/tcp or custom) from untrusted or external IP addresses; large or malformed syslog frames in network captures.
• Logs: Absence of new log entries from rsyslogd following a period of normal activity; system journal entries (e.g., journalctl) showing rsyslogd process termination or restart events.
• Process: rsyslogd process absent from the process list (ps aux | grep rsyslogd); systemd or init reporting unexpected rsyslogd service failures or restart loops.
• File System: Core dump files generated by rsyslogd in /var/core/, /tmp/, or the working directory of the rsyslogd process, if core dumps are enabled.

The fix is included in rsyslog daily stable builds published on or after 2026-07-23 (CEST) and will be included in the next scheduled stable release (8.2608.0 or later); users should upgrade to the patched version (GitHub Advisory). Until an upgrade is possible, Red Hat recommends one of the following mitigations: (1) remove framing.delimiter.regex from affected imptcp inputs and use standard framing, (2) replace the affected imptcp listener with an equivalent imtcp listener, (3) disable the affected imptcp listener or unload the imptcp module entirely if not required, or (4) restrict network access to the listener to trusted senders only via firewall rules or TCP wrappers (Red Hat Advisory).

Red Hat Product Security rated this vulnerability as Moderate severity for supported Red Hat Enterprise Linux products (downgraded from the upstream High/Important rating), noting that the vulnerable non-default configuration is not present in standard RHEL rsyslog deployments (Red Hat Advisory). The upstream rsyslog maintainer (rgerhards) published the GitHub Security Advisory and credited Raphael Eikenberg (eikendev) for responsible disclosure (GitHub Advisory). Community coverage has been limited to automated vulnerability tracking platforms such as VulDB, CVEFeed, and Tenable Nessus plugin detection, with no significant broader media or researcher commentary identified.