Detections
Analytics

Echo: rsyslog: security update to 8.2504.0-1+deb13u2+e1

high Tenable Self-Hosted Container Security Plugin ID 474785

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp
 module's parse_auth_header function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with
 calloc(0, len) when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes that
 pointer to apr_base64_decode. An unauthenticated remote attacker can send an oversized encoded credential
 to an imhttp endpoint configured for Basic Authentication, causing decoded data to overwrite adjacent heap
 memory before credential validation. Deployments that do not install, load, and use imhttp with Basic
 Authentication are not affected. The demonstrated impact is a process crash that interrupts log
 collection, and code execution has not been demonstrated. This issue is fixed in version 8.2604.0.
 (CVE-2026-55556)

Solution

Update the rsyslog library and its related packages to version 8.2504.0-1+deb13u2+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-55556

Plugin Details

Severity: High

ID: 474785

Version: Revision 1.1

Type: Local

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.58

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2026-55556

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.2

Threat Score: 4.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/27/2026

Vulnerability Publication Date: 7/6/2026

Reference Information

CVE: CVE-2026-55556