CVE-2026-78002: 
rsyslog vulnerability analysis and mitigation

CVE-2026-78002 is a heap buffer overflow vulnerability in rsyslog's RainerScript replace() function (and the three-argument form of wrap()) that allows an unauthenticated remote attacker to trigger memory corruption by sending specially crafted syslog messages, resulting in a denial of service (DoS). The flaw stems from an incorrect buffer size calculation (CWE-131 / CWE-122) during string replacement in grammar/rainerscript.c. Affected versions span rsyslog 8.6.0 through 8.2608.0; the vulnerability was introduced in 8.6.0. It was publicly disclosed on August 26–29, 2026, with a fix available in the 2026-08-24 daily stable build. The CVSS v3.1 base score is 7.5 (High) (Red Hat CVE, GitHub Advisory, oss-security).

The root cause lies in doFuncReplace() in grammar/rainerscript.c, which implements replace(source, find, replaceWith) using two passes: pass 1 computes the required output buffer length, and pass 2 allocates and fills it. On a partial-match failure, the two passes rewind by different amounts — pass 1 does i -= (j - 1) while pass 2 does i -= j — causing pass 2 to identify replacement positions that pass 1 missed. When replaceWith is longer than find, each such missed match causes the allocation to be short by lReplaceWith - lfind bytes, and pass 2 writes past the end of the heap buffer without bounds checking (Red Hat Bugzilla, oss-security). Exploitation requires: a ruleset applying replace() or three-argument wrap() to attacker-controlled message data; a search string of at least two characters; a replacement string longer than the search string; and input containing the specific partial-match pattern that causes the two passes to diverge. Since the source string is typically a message property ($msg, $rawmsg, etc.), an unauthenticated remote syslog sender can control the number of missed matches and thus the overflow magnitude (GitHub Advisory). The fix aligns both passes to use i -= j, ensuring consistent rewind behavior (oss-security).

Successful exploitation causes heap corruption and termination of the rsyslogd daemon, interrupting all log processing on the affected system. The primary impact is availability loss — systems configured to receive remote syslog messages and apply replace() to that data will lose logging functionality, which can blind security monitoring and audit pipelines. Confidentiality loss, integrity loss, and remote code execution have not been demonstrated in practice (GitHub Advisory, oss-security). Red Hat notes that RHEL systems configured to receive remote syslog messages are susceptible, potentially impacting logging availability across enterprise environments (Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure (Feedly). The vulnerability is automatable (no user interaction or authentication required) when the target configuration applies replace() or three-argument wrap() to network-received message data, but practical exposure is limited to deployments with such rulesets — it is not active in the default rsyslog configuration (oss-security). The EPSS score is approximately 0.006 (0.6%), reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The heap buffer overflow and daemon termination were reproduced with AddressSanitizer by Ada Logics during validation (GitHub Advisory).

1. Reconnaissance: Identify rsyslog instances (versions 8.6.0–8.2608.0) that accept remote syslog messages over UDP/TCP port 514 and whose rulesets apply replace() or three-argument wrap() to incoming message content. This can be done via network scanning (e.g., Shodan, Censys, nmap) or by reviewing exposed rsyslog configuration files.
2. Craft the trigger payload: Construct a syslog message whose body (mapped to $msg or $rawmsg) contains a string that produces the partial-match divergence pattern. Specifically, the message must include a substring that partially matches the find argument of replace() at a position one byte after a failed partial match, with the replaceWith argument longer than find.
3. Send the malicious syslog message: Transmit the crafted message to the target's syslog listener (UDP/TCP port 514) using standard syslog tooling (e.g., logger, netcat, or a custom script). No authentication is required if the input module (imudp/imtcp) accepts unauthenticated senders.
4. Trigger heap overflow: When rsyslogd processes the message through the affected ruleset, doFuncReplace() allocates an undersized buffer and writes past its end, causing heap corruption.
5. Achieve DoS: The heap corruption causes rsyslogd to crash and terminate, halting all log processing on the target system (oss-security, Red Hat Bugzilla).

• Logs: Unexpected rsyslogd crash entries in /var/log/messages or the system journal (e.g., rsyslogd process exiting with a signal such as SIGABRT or SIGSEGV); AddressSanitizer heap-buffer-overflow reports if rsyslog is compiled with ASAN.
• Process: Sudden absence of the rsyslogd process; repeated automatic restarts of the rsyslog service (visible via systemctl status rsyslog or journalctl -u rsyslog).
• Network: Unusual or malformed syslog messages arriving on UDP/TCP port 514 from unexpected source IPs, particularly messages with repeated patterns designed to trigger partial-match divergence in replace() calls.
• File System: Core dump files (e.g., core.*) generated by rsyslogd in the working directory or configured core dump path, indicating abnormal process termination (oss-security, Red Hat CVE).

Update rsyslog to the 2026-08-24 daily stable build or later; the fix will also be included in the scheduled rsyslog 8.2610.0 release (oss-security, GitHub Advisory). Until patching is possible, apply one or more of the following workarounds:

• Remove or rewrite rulesets that apply replace() or three-argument wrap() to untrusted/sender-controlled message content.
• Ensure the replacement string is not longer than the search string in any replace() call.
• Restrict network inputs (imudp, imtcp) to trusted senders using firewall rules limiting UDP/TCP port 514 to known hosts.
• If remote syslog reception is not required, disable the imudp and imtcp modules in /etc/rsyslog.conf and restart the rsyslog service (Red Hat CVE).

The vulnerability was discovered by Anthropic using Claude as part of an AI-assisted open-source security research effort and manually validated by Ada Logics; it was reported by David Korczynski (GitHub Advisory). Rainer Gerhards, the rsyslog project lead, posted the public disclosure to the oss-security mailing list on August 29, 2026, noting the delayed posting due to the embargo period ending August 24, 2026 (oss-security). Red Hat classified the flaw as "Important" and published a detailed advisory with mitigation guidance for RHEL users (Red Hat CVE). The case is notable as an example of AI-assisted vulnerability discovery in widely deployed open-source infrastructure software.