Most recent entries from all

ALSA-2026:69540 — Important: rsyslog security update

Affected: AlmaLinux:9: rsyslog, AlmaLinux:9: rsyslog-crypto, AlmaLinux:9: rsyslog-doc, AlmaLinux:9: rsyslog-elasticsearch, AlmaLinux:9: rsyslog-gnutls, AlmaLinux:9: rsyslog-gssapi, AlmaLinux:9: rsyslog-kafka, AlmaLinux:9: rsyslog-logrotate, AlmaLinux:9: rsyslog-mmaudit, AlmaLinux:9: rsyslog-mmfields and 11 more

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format.

Security Fix(es):

* rsyslog: rsyslog: Denial of service via heap buffer overflow in RainerScript replace() function (CVE-2026-78002)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

fkie_cve-2026-78002

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.

msrc_CVE-2026-78002 — Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function

msrc_CVE-2026-78002

OESA-2026-3838 — rsyslog security update

Affected: openEuler:20.03-LTS-SP4: rsyslog

RSYSLOG is the rocket-fast system for log processing.It offers high-performance, great security features and a modular design. While it started as a regular syslogd, rsyslog has evolved into a kind of swiss army knife of logging, being able to accept inputs from a wide variety of sources, transform them, and output to the results to diverse destinations. Security Fix(es):

Rsyslog is an open-source log processing system. The replace() function in the RainerScript scripting language has a heap buffer overflow vulnerability due to incorrect calculation of buffer size (CWE-131), leading to a heap-based buffer overflow (CWE-122). An attacker could exploit this vulnerability to cause denial of service or potential code execution.(CVE-2026-78002)

RHSA-2026:69540 — Red Hat Security Advisory: rsyslog security update

rsyslog: rsyslog: Denial of service via heap buffer overflow in RainerScript replace() function

RHSA-2026:71603 — Red Hat Security Advisory: Red Hat Update Infrastructure 5.3 security update

postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin curl: libcurl: Unauthorized connection reuse due to a logical error curl: Information disclosure due to uncleared proxy authentication state openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server openssl: RPK server signature algorithm selection can dereference a missing certificate postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound postgresql: Postg…

RLSA-2026:69540 — Important: rsyslog security update

Affected: Rocky Linux:9: rsyslog

Security Fix(es):

* rsyslog: rsyslog: Denial of service via heap buffer overflow in RainerScript replace() function (CVE-2026-78002)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

UBUNTU-CVE-2026-78002

Affected: Ubuntu:Pro:16.04:LTS: rsyslog, Ubuntu:Pro:18.04:LTS: rsyslog, Ubuntu:Pro:20.04:LTS: rsyslog, Ubuntu:22.04:LTS: rsyslog, Ubuntu:24.04:LTS: rsyslog, Ubuntu:26.04:LTS: rsyslog