A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67584 advisory.

    * rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an     unauthenticated remote peer to crash rsyslogd (CVE-2026-19654)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67583 advisory.

    * rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an     unauthenticated remote peer to crash rsyslogd (CVE-2026-19654)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1860:02 advisory.

    * rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an     unauthenticated remote peer to crash rsyslogd (CVE-2026-19654)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-67583 advisory.

    [8.2510.0-2.0.1.el9_8.1]
    - Fixes rsyslog segfault during shutdown when relp is configured with TLS [Orabug: 37588023]

    [8.2510.0-2.1]
    - Backport: imptcp: guard regex-framing match against iCurrLine == 0       Resolves: RHEL-212699

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67583 advisory.

    * rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an     unauthenticated remote peer to crash rsyslogd (CVE-2026-19654)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67584 advisory.

    * rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an     unauthenticated remote peer to crash rsyslogd (CVE-2026-19654)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-67584 advisory.

    [8.2510.0-5.1]
    - Backport: guard regex-framing match against iCurrLine == 0 to fix crash       Resolves: RHEL-212700

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67584 advisory.

    The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC     3195, permitted sender lists, filtering on any message part, and fine-grained control over output format.

    Security Fix(es):

    * rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an     unauthenticated remote peer to crash rsyslogd (CVE-2026-19654)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67583 advisory.

    The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC     3195, permitted sender lists, filtering on any message part, and fine-grained control over output format.

    Security Fix(es):

    * rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an     unauthenticated remote peer to crash rsyslogd (CVE-2026-19654)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:66405 advisory.

    The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC     3195, permitted sender lists, filtering on any message part, and fine-grained control over output format.

    Security Fix(es):

    * rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an     unauthenticated remote peer to crash rsyslogd (CVE-2026-19654)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106764 advisory.

    A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A     crafted input sequence during oversize-frame recovery can cause an invalid internal message length and     terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has     been identified. imtcp and the default imptcp framing modes are not affected.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0885 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-19654:
    A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A     crafted input sequence during oversize-frame recovery can cause an invalid internal message length and     terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has     been identified. imtcp and the default imptcp framing modes are not affected.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2118 advisory.

    A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A     crafted input sequence during oversize-frame recovery can cause an invalid internal message length and     terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has     been identified. imtcp and the default imptcp framing modes are not affected. (CVE-2026-19654)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A     crafted input sequence during oversize-frame recovery can cause an invalid internal message length and     terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has     been identified. imtcp and the default imptcp framing modes are not affected. (CVE-2026-19654)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
349083	RockyLinux 10 : rsyslog (RLSA-2026:67584)	Nessus	Rocky Linux Local Security Checks	Local	high
349079	RockyLinux 9 : rsyslog (RLSA-2026:67583)	Nessus	Rocky Linux Local Security Checks	Local	high
346816	MiracleLinux 9 : rsyslog-8.2510.0-2.el9_8.1 (AXSA:2026-1860:02)	Nessus	Miracle Linux Local Security Checks	Local	high
346425	Oracle Linux 9 : rsyslog (ELSA-2026-67583)	Nessus	Oracle Linux Local Security Checks	Local	high
346304	AlmaLinux 9 : rsyslog (ALSA-2026:67583)	Nessus	Alma Linux Local Security Checks	Local	high
346303	AlmaLinux 10 : rsyslog (ALSA-2026:67584)	Nessus	Alma Linux Local Security Checks	Local	high
346185	Oracle Linux 10 : rsyslog (ELSA-2026-67584)	Nessus	Oracle Linux Local Security Checks	Local	high
346042	RHEL 10 : rsyslog (RHSA-2026:67584)	Nessus	Red Hat Local Security Checks	Local	high
346039	RHEL 9 : rsyslog (RHSA-2026:67583)	Nessus	Red Hat Local Security Checks	Local	high
344581	RHEL 10 : rsyslog (RHSA-2026:66405)	Nessus	Red Hat Local Security Checks	Local	high
344445	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: rsyslog (UTSA-2026-106764)	Nessus	Unity Linux Local Security Checks	Local	high
342179	TencentOS Server 4: rsyslog (TSSA-2026:0885)	Nessus	Tencent Local Security Checks	Local	high
341871	Amazon Linux 2023 : rsyslog, rsyslog-crypto, rsyslog-elasticsearch (ALAS2023-2026-2118)	Nessus	Amazon Linux Local Security Checks	Local	high
334997	Linux Distros Unpatched Vulnerability : CVE-2026-19654	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-19654

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high