CVE-2026-39879

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39879", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-07T20:32:03.010Z", "datePublished": "2026-07-20T16:57:32.019Z", "dateUpdated": "2026-07-21T16:11:18.899Z"}, "containers": {"cna": {"title": "SQL injection in syslog-ng SQL destionation driver", "problemTypes": [{"descriptions": [{"cweId": "CWE-150", "lang": "en", "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-qwf9-6222-m24m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-qwf9-6222-m24m"}], "affected": [{"vendor": "syslog-ng", "product": "syslog-ng", "versions": [{"version": "< 4.12", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T16:57:32.019Z"}, "descriptions": [{"lang": "en", "value": "Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured.\n\nFixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and syslog-ng Store Box 7.8"}], "source": {"advisory": "GHSA-qwf9-6222-m24m", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-21T16:08:55.745841Z", "id": "CVE-2026-39879", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T16:11:18.899Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39879", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T16:08:55.745841Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T16:11:12.566Z"}}], "cna": {"title": "SQL injection in syslog-ng SQL destionation driver", "source": {"advisory": "GHSA-qwf9-6222-m24m", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "syslog-ng", "product": "syslog-ng", "versions": [{"status": "affected", "version": "< 4.12"}]}], "references": [{"url": "https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-qwf9-6222-m24m", "name": "https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-qwf9-6222-m24m", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured.\n\nFixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and syslog-ng Store Box 7.8"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-150", "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T16:57:32.019Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39879", "state": "PUBLISHED", "dateUpdated": "2026-07-21T16:11:18.899Z", "dateReserved": "2026-04-07T20:32:03.010Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-20T16:57:32.019Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "syslog-ng", "vendor": "syslog-ng", "versions": [{"status": "affected", "version": "< 4.12"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured.\n\nFixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and syslog-ng Store Box 7.8"}], "id": "CVE-2026-39879", "lastModified": "2026-07-23T16:04:11.740", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39879", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-21T16:08:55.745841Z", "version": "2.0.3"}}]}, "published": "2026-07-20T17:17:07.550", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-qwf9-6222-m24m"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-150"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "syslog-ng: syslog-ng: SQL Injection vulnerability leading to denial of service and data manipulation", "id": "2502916", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502916"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "status": "draft"}, "cwe": "CWE-150", "details": ["A flaw was found in syslog-ng. An attacker on an adjacent network can exploit a missing sanitization call in the `afsql_dd_run_query` function, leading to a SQL injection vulnerability. This vulnerability, when the SQL driver is manually configured, can result in a denial of service and allow for limited data manipulation from an untrusted source."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, avoid manually configuring and enabling the syslog-ng SQL driver if it is not essential for your environment. If the SQL driver is required, restrict network access to the syslog-ng instance to trusted networks only, for example, by configuring firewall rules to limit connections to the syslog-ng port. Note that changes to network configurations or syslog-ng service settings may require a service reload or restart to take effect, which could temporarily interrupt logging services."}, "name": "CVE-2026-39879", "public_date": "2026-07-20T16:57:32Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-39879\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-39879\nhttps://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-qwf9-6222-m24m"], "statement": "This is an Important flaw in syslog-ng, as an attacker on an adjacent network could perform SQL injection. This vulnerability is not present in default configurations and requires the SQL driver to be manually configured, limiting its immediate impact on typical Red Hat deployments. Successful exploitation could lead to denial of service and limited data manipulation.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.12)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "syslog-ng", "source": "cna", "vendor": "syslog-ng"}, "product": "syslog-ng", "vendor": "syslog-ng"}], "created": "2026-07-23T21:21:41.962407+00:00", "updated": "2026-07-30T19:00:09.769354+00:00", "vendors": ["syslog-ng", "syslog-ng$PRODUCT$syslog-ng"]}