CVE-2026-55556: 
rsyslog vulnerability analysis and mitigation

CVE-2026-55556 is a heap overflow vulnerability in the HTTP Basic Authentication parser of the optional rsyslog imhttp input module. When Basic Authentication is enabled and a remote client can reach the imhttp HTTP endpoint, the flaw can be triggered to cause at least denial of service, with potential for stronger impact depending on platform and hardening configuration. The vulnerability was disclosed on June 23, 2026 by Rainer Gerhards via the oss-security mailing list. It is estimated as HIGH severity by Feedly; an official CVSS score has not yet been published as the CVE remains in Reserved status (oss-security, Feedly).

The root cause is a classic heap allocation bug (CWE-122: Heap-based Buffer Overflow) in contrib/imhttp/imhttp.c. The vulnerable code called calloc(0, len) instead of calloc(1, len) when decoding an oversized HTTP Basic Authentication header, resulting in a zero-byte allocation followed by a write of len bytes into that buffer — corrupting heap memory. Exploitation requires the attacker to send a crafted HTTP request with an oversized Authorization: Basic header to the imhttp listener. The fix replaces the erroneous calloc(0, len) with calloc(1, len), and the upstream refactor additionally replaced the entire dynamic work-buffer allocation with bounded parsing capped on Basic Auth header size (oss-security).

Successful exploitation leads at minimum to denial of service by corrupting heap memory in the rsyslog process. Stronger impacts — such as arbitrary code execution — are theoretically possible but depend on platform, memory allocator behavior, compiler options, and process hardening measures in place. The attack surface is limited to deployments where imhttp is explicitly built, installed, loaded, configured, and has Basic Authentication enabled, which is not the case for default rsyslog installations (oss-security).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability is remotely exploitable by an unauthenticated attacker who can reach the imhttp HTTP endpoint, requiring no prior authentication. The CVE is currently in Reserved status and has not been added to the CISA Known Exploited Vulnerabilities catalog. Nessus plugin 322300 has been released to detect affected configurations (Tenable, Feedly).

1. Reconnaissance: Identify rsyslog instances with the imhttp module loaded and listening on an HTTP port (commonly via network scanning with tools like Nmap targeting common HTTP ports).
2. Confirm Basic Auth is enabled: Send a standard HTTP GET request to the imhttp endpoint; a 401 Unauthorized response with a WWW-Authenticate: Basic header confirms Basic Authentication is active.
3. Craft malicious request: Construct an HTTP request with an oversized Authorization: Basic header — specifically, a Base64-encoded value whose decoded length exceeds the internal workbuf size, triggering the calloc(0, len) path.
4. Trigger heap corruption: Send the crafted request to the imhttp listener. The zero-byte allocation followed by a write of len bytes corrupts heap memory, causing the rsyslog process to crash (denial of service) or, under favorable conditions, potentially enabling further exploitation (oss-security).

• Network: Unusual HTTP requests to the rsyslog imhttp listener port containing abnormally large Authorization: Basic headers (Base64-encoded values significantly exceeding typical credential lengths).
• Logs: rsyslog process crash or restart events in system logs (e.g., journalctl or /var/log/syslog) coinciding with HTTP requests to the imhttp endpoint; segmentation fault or heap corruption error messages from rsyslog.
• Process: Unexpected termination or restart of the rsyslogd process; core dump files generated by rsyslogd in the working directory or /var/crash/.

The affected code path was removed in rsyslog 8.2604.0 via commit acde2ba25ea33816694b787859f4a727a247b6d6, which refactored imhttp authentication to use bounded parsing and route-scoped API key authentication. For downstreams maintaining older branches, a minimal targeted fix is to change calloc(0, len) to calloc(1, len) in contrib/imhttp/imhttp.c at line ~702. As an immediate workaround, disable HTTP Basic Authentication for the imhttp endpoint or disable/unload the imhttp module entirely if it is not required — noting that default rsyslog configurations do not load imhttp (oss-security).

The vulnerability was responsibly disclosed by Rainer Gerhards (rsyslog maintainer) on the oss-security mailing list on June 23, 2026, crediting the reporter and fix provider as 0xseiryuu. The disclosure was straightforward and technically detailed, with the maintainer emphasizing the limited deployment scope of the affected module. No significant broader media coverage or notable community controversy has been observed (oss-security).