CVE-2026-55556

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55556", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-16T23:11:20.213Z", "datePublished": "2026-09-18T16:53:29.184Z", "dateUpdated": "2026-09-22T15:04:35.228Z"}, "containers": {"cna": {"title": "Rsyslog: Heap buffer overflow in imhttp plugin Basic Authentication handling", "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "lang": "en", "description": "CWE-122: Heap-based Buffer Overflow", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/rsyslog/rsyslog/security/advisories/GHSA-947w-69ph-mc2r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rsyslog/rsyslog/security/advisories/GHSA-947w-69ph-mc2r"}, {"name": "https://github.com/rsyslog/rsyslog/pull/6722", "tags": ["x_refsource_MISC"], "url": "https://github.com/rsyslog/rsyslog/pull/6722"}, {"name": "https://github.com/rsyslog/rsyslog/commit/acde2ba25ea33816694b787859f4a727a247b6d6", "tags": ["x_refsource_MISC"], "url": "https://github.com/rsyslog/rsyslog/commit/acde2ba25ea33816694b787859f4a727a247b6d6"}, {"name": "https://github.com/rsyslog/rsyslog/releases/tag/v8.2604.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/rsyslog/rsyslog/releases/tag/v8.2604.0"}], "affected": [{"vendor": "rsyslog", "product": "rsyslog", "versions": [{"version": ">= 8.2110.0, < 8.2604.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-18T16:53:29.184Z"}, "descriptions": [{"lang": "en", "value": "Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parse_auth_header function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc(0, len) when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes that pointer to apr_base64_decode. An unauthenticated remote attacker can send an oversized encoded credential to an imhttp endpoint configured for Basic Authentication, causing decoded data to overwrite adjacent heap memory before credential validation. Deployments that do not install, load, and use imhttp with Basic Authentication are not affected. The demonstrated impact is a process crash that interrupts log collection, and code execution has not been demonstrated. This issue is fixed in version 8.2604.0."}], "source": {"advisory": "GHSA-947w-69ph-mc2r", "discovery": "UNKNOWN"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/06/23/4"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-18T17:11:21.074Z"}}, {"references": [{"url": "https://github.com/rsyslog/rsyslog/security/advisories/GHSA-947w-69ph-mc2r", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-22T15:04:09.398563Z", "id": "CVE-2026-55556", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-22T15:04:35.228Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/06/23/4"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-18T17:11:21.074Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55556", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-22T15:04:09.398563Z"}}}], "references": [{"url": "https://github.com/rsyslog/rsyslog/security/advisories/GHSA-947w-69ph-mc2r", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-22T15:04:29.388Z"}}], "cna": {"title": "Rsyslog: Heap buffer overflow in imhttp plugin Basic Authentication handling", "source": {"advisory": "GHSA-947w-69ph-mc2r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "rsyslog", "product": "rsyslog", "versions": [{"status": "affected", "version": ">= 8.2110.0, < 8.2604.0"}]}], "references": [{"url": "https://github.com/rsyslog/rsyslog/security/advisories/GHSA-947w-69ph-mc2r", "name": "https://github.com/rsyslog/rsyslog/security/advisories/GHSA-947w-69ph-mc2r", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/rsyslog/rsyslog/pull/6722", "name": "https://github.com/rsyslog/rsyslog/pull/6722", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rsyslog/rsyslog/commit/acde2ba25ea33816694b787859f4a727a247b6d6", "name": "https://github.com/rsyslog/rsyslog/commit/acde2ba25ea33816694b787859f4a727a247b6d6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rsyslog/rsyslog/releases/tag/v8.2604.0", "name": "https://github.com/rsyslog/rsyslog/releases/tag/v8.2604.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parse_auth_header function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc(0, len) when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes that pointer to apr_base64_decode. An unauthenticated remote attacker can send an oversized encoded credential to an imhttp endpoint configured for Basic Authentication, causing decoded data to overwrite adjacent heap memory before credential validation. Deployments that do not install, load, and use imhttp with Basic Authentication are not affected. The demonstrated impact is a process crash that interrupts log collection, and code execution has not been demonstrated. This issue is fixed in version 8.2604.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-18T16:53:29.184Z"}}}, "cveMetadata": {"cveId": "CVE-2026-55556", "state": "PUBLISHED", "dateUpdated": "2026-09-22T15:04:35.228Z", "dateReserved": "2026-06-16T23:11:20.213Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-18T16:53:29.184Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "rsyslog", "vendor": "rsyslog", "versions": [{"status": "affected", "version": ">= 8.2110.0, < 8.2604.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parse_auth_header function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc(0, len) when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes that pointer to apr_base64_decode. An unauthenticated remote attacker can send an oversized encoded credential to an imhttp endpoint configured for Basic Authentication, causing decoded data to overwrite adjacent heap memory before credential validation. Deployments that do not install, load, and use imhttp with Basic Authentication are not affected. The demonstrated impact is a process crash that interrupts log collection, and code execution has not been demonstrated. This issue is fixed in version 8.2604.0."}], "id": "CVE-2026-55556", "lastModified": "2026-09-24T21:22:19.873", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55556", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-22T15:04:09.398563Z", "version": "2.0.3"}}]}, "published": "2026-09-18T17:16:57.580", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/rsyslog/rsyslog/commit/acde2ba25ea33816694b787859f4a727a247b6d6"}, {"source": "security-advisories@github.com", "url": "https://github.com/rsyslog/rsyslog/pull/6722"}, {"source": "security-advisories@github.com", "url": "https://github.com/rsyslog/rsyslog/releases/tag/v8.2604.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/rsyslog/rsyslog/security/advisories/GHSA-947w-69ph-mc2r"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/06/23/4"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/rsyslog/rsyslog/security/advisories/GHSA-947w-69ph-mc2r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "rsyslog: Rsyslog: Denial of Service via heap buffer overflow in imhttp module", "id": "2538463", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538463"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-131", "details": ["Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parse_auth_header function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc(0, len) when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes that pointer to apr_base64_decode. An unauthenticated remote attacker can send an oversized encoded credential to an imhttp endpoint configured for Basic Authentication, causing decoded data to overwrite adjacent heap memory before credential validation. Deployments that do not install, load, and use imhttp with Basic Authentication are not affected. The demonstrated impact is a process crash that interrupts log collection, and code execution has not been demonstrated. This issue is fixed in version 8.2604.0.", "A flaw was found in Rsyslog, a system for log processing, specifically in its optional imhttp module. An attacker can remotely trigger a heap buffer overflow by sending a specially crafted, oversized credential to an imhttp endpoint configured for Basic Authentication. This can lead to a system crash, disrupting log collection. This vulnerability affects deployments that have installed, loaded, and use the imhttp module with Basic Authentication."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, ensure that the `imhttp` module is not loaded or configured with Basic Authentication if not strictly required. If the `imhttp` module is in use, review its configuration to remove Basic Authentication settings. After making configuration changes, the rsyslog service must be restarted for the changes to take effect."}, "name": "CVE-2026-55556", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "rsyslog", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "rsyslog", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "rsyslog7", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "rsyslog", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "rsyslog", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "rhel9/rsyslog", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "rsyslog", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-09-18T16:53:29Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-55556\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-55556\nhttp://www.openwall.com/lists/oss-security/2026/06/23/4\nhttps://github.com/rsyslog/rsyslog/commit/acde2ba25ea33816694b787859f4a727a247b6d6\nhttps://github.com/rsyslog/rsyslog/pull/6722\nhttps://github.com/rsyslog/rsyslog/releases/tag/v8.2604.0\nhttps://github.com/rsyslog/rsyslog/security/advisories/GHSA-947w-69ph-mc2r"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.2110.0,8.2604.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "rsyslog", "source": "cna", "vendor": "rsyslog"}, "product": "rsyslog", "vendor": "rsyslog"}], "created": "2026-09-19T12:15:17.528736+00:00", "updated": "2026-09-23T17:00:08.052310+00:00", "vendors": ["rsyslog", "rsyslog$PRODUCT$rsyslog"]}