CVE-2026-61548: 
rsyslog vulnerability analysis and mitigation

CVE-2026-61548 is a stack-based buffer overflow vulnerability in rsyslog's optional mmpstrucdata plugin, triggered when parsing oversized RFC5424 structured-data parameter values. It affects rsyslog versions 7.5.4 (2013) and above, with the fix introduced in version 8.2606.0. The vulnerability was reported by mikecole-mg and published on July 20, 2026, with Ubuntu issuing a security notice on July 23, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Ubuntu Advisory).

The root cause is a CWE-121 (Stack-based Buffer Overflow) in plugins/mmpstrucdata/mmpstrucdata.c. The function parseSD_PARAM() allocates a fixed 32,768-byte stack buffer (pVal[32*1024]) and passes it to parsePARAM_VALUE() without a size argument. parsePARAM_VALUE() writes into the buffer bounded only by lenbuf (the structured-data length), with no destination-size check, allowing a crafted RFC5424 message with an oversized structured-data parameter value to overflow the stack buffer. Exploitation requires that mmpstrucdata is loaded and active in the rsyslog configuration, attacker-controlled RFC5424 messages reach the affected action, and MaxMessageSize is configured above 32,793 bytes. A public PoC script demonstrating crashes via both TCP and UDP on Debian 12 with rsyslog 8.2302.0 has been published (GitHub Advisory).

Successful exploitation of an affected configuration allows a remote unauthenticated attacker to crash the rsyslog process, causing denial of service and interruption of log collection. Because the stack is overwritten with attacker-controlled data, code execution may be theoretically possible on some platforms or builds depending on compiler and runtime hardening, though this has not been demonstrated on standard hardened glibc-based distribution builds. Loss of log collection can impair security monitoring, incident detection, and compliance logging pipelines (GitHub Advisory, Ubuntu Advisory).

A public proof-of-concept Python script has been published as part of the GitHub Security Advisory, demonstrating crashes via TCP and UDP inputs on Debian 12. The CVE status remains "Reserved" and there is no current evidence of in-the-wild exploitation or threat actor attribution. The CVSS Attack Complexity is rated High due to the non-default configuration prerequisites (mmpstrucdata loaded, MaxMessageSize above 32,793 bytes). No EPSS score or CISA KEV catalog entry has been identified for this CVE (GitHub Advisory).

1. Reconnaissance: Identify rsyslog instances that load the mmpstrucdata plugin and have MaxMessageSize configured above 32,793 bytes (e.g., via exposed configuration files, service banners, or network scanning for syslog ports 514/TCP or 514/UDP).
2. Craft malicious RFC5424 message: Construct a syslog message with a structured-data parameter value exceeding 32,768 bytes. Example payload structure: <14>1 2026-05-06T00:00:00Z - - - - [test k="AAAA...A (35000 bytes)"] overflow\n.
3. Deliver the payload: Send the crafted message to the target rsyslog input (TCP or UDP port 514) using a script or tool such as the published PoC: python3 poc.py <target_ip> 514 35000.
4. Trigger buffer overflow: The oversized structured-data value causes parsePARAM_VALUE() to write beyond the 32,768-byte stack buffer in parseSD_PARAM(), overflowing the stack.
5. Achieve denial of service (or potential code execution): The rsyslog process crashes, interrupting log collection. On platforms without sufficient stack hardening, further exploitation for code execution may be possible (GitHub Advisory).

• Network: Unusually large syslog messages (>32,793 bytes) arriving on TCP/UDP port 514, particularly RFC5424-formatted messages with oversized structured-data parameter values (e.g., [id key="AAAA...A"]).
• Logs: Sudden absence of rsyslog log entries indicating process crash; kernel or system logs (e.g., /var/log/syslog, journalctl) showing rsyslog segmentation fault or abnormal termination.
• Process: rsyslog process unexpectedly restarting or absent from the process list (ps aux | grep rsyslog); core dump files generated in the rsyslog working directory or /var/crash/.
• File System: Presence of core dump files (e.g., core, rsyslogd.core) in system directories following unexpected rsyslog termination (GitHub Advisory).

The upstream fix is included in rsyslog version 8.2606.0, which replaces the fixed-size stack buffer with a dynamically allocated buffer sized to lenbuf + 1. Ubuntu has released patched packages: rsyslog 8.2512.0-1ubuntu4.1 (26.04 LTS), 8.2312.0-3ubuntu9.3 (24.04 LTS), and 8.2112.0-2ubuntu2.4 (22.04 LTS). A SUSE security update (SUSE-SU-2026:3442-1) and an openSUSE advisory have also been issued. For deployments that cannot immediately update, mitigations include: not loading or using mmpstrucdata unless required; restricting network inputs that feed actions using mmpstrucdata; and keeping MaxMessageSize below 32,793 bytes where operationally feasible (GitHub Advisory, Ubuntu Advisory).

The vulnerability was disclosed via the oss-security mailing list on July 20, 2026, and quickly picked up by Linux security news outlets including pro-linux.de and linuxsecurity.com. Ubuntu, SUSE/openSUSE, and AUSCERT issued advisories within days of disclosure. Tenable published a Nessus detection plugin (ID 329553) for the vulnerability. Community reaction has been measured, noting that the non-default configuration prerequisites (mmpstrucdata loaded, elevated MaxMessageSize) limit the practical exposure for most deployments (oss-security, Ubuntu Advisory).