Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parse_auth_header function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc(0, len) when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes that pointer to apr_base64_decode. An unauthenticated remote attacker can send an oversized encoded credential to an imhttp endpoint configured for Basic Authentication, causing decoded data to overwrite adjacent heap memory before credential validation. Deployments that do not install, load, and use imhttp with Basic Authentication are not affected. The demonstrated impact is a process crash that interrupts log collection, and code execution has not been demonstrated. This issue is fixed in version 8.2604.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp
    module's parse_auth_header function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with
    calloc(0, len) when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes that
    pointer to apr_base64_decode. An unauthenticated remote attacker can send an oversized encoded credential
    to an imhttp endpoint configured for Basic Authentication, causing decoded data to overwrite adjacent heap
    memory before credential validation. Deployments that do not install, load, and use imhttp with Basic
    Authentication are not affected. The demonstrated impact is a process crash that interrupts log
    collection, and code execution has not been demonstrated. This issue is fixed in version 8.2604.0.
    (CVE-2026-55556)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp     module's parse_auth_header function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with     calloc(0, len) when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes that     pointer to apr_base64_decode. An unauthenticated remote attacker can send an oversized encoded credential     to an imhttp endpoint configured for Basic Authentication, causing decoded data to overwrite adjacent heap     memory before credential validation. Deployments that do not install, load, and use imhttp with Basic     Authentication are not affected. The demonstrated impact is a process crash that interrupts log     collection, and code execution has not been demonstrated. This issue is fixed in version 8.2604.0.
    (CVE-2026-55556)

  - Debian Linux - rsyslog - None  Ubuntu Linux - [Unknown description] (CVE-2026-55556)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
474785	Echo: rsyslog: security update to 8.2504.0-1+deb13u2+e1	Tenable Cloud Security	Echo Local Security Checks	Local	high
474785	Echo: rsyslog: security update to 8.2504.0-1+deb13u2+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
322300	Linux Distros Unpatched Vulnerability : CVE-2026-55556	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-55556

high

Tenable Plugins

high

high

high