Detections
Analytics
Alpine: multiple rsyslog packages: security update to 8.2608.0-r0
high Tenable Self-Hosted Container Security Plugin ID 478598
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A
crafted input sequence during oversize-frame recovery can cause an invalid internal message length and
terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has
been identified. imtcp and the default imptcp framing modes are not affected. (CVE-2026-19654)
- Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp
module's parse_auth_header function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with
calloc(0, len) when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes that
pointer to apr_base64_decode. An unauthenticated remote attacker can send an oversized encoded credential
to an imhttp endpoint configured for Basic Authentication, causing decoded data to overwrite adjacent heap
memory before credential validation. Deployments that do not install, load, and use imhttp with Basic
Authentication are not affected. The demonstrated impact is a process crash that interrupts log
collection, and code execution has not been demonstrated. This issue is fixed in version 8.2604.0.
(CVE-2026-55556)
- Rsyslog is a rocket-fast system for log processing. From 7.5.4 until 8.2606.0, the optional mmpstrucdata
plugin's parseSD_PARAM function in plugins/mmpstrucdata/mmpstrucdata.c stores RFC5424 parameter values in
a fixed pVal[32 * 1024] stack buffer and calls parsePARAM_VALUE without supplying the destination size. A
remote unauthenticated attacker whose crafted RFC5424 message reaches an action using mmpstrucdata can
provide a structured-data parameter larger than that buffer when MaxMessageSize permits it, causing an
attacker-controlled stack overwrite. Deployments that do not install and use the plugin, or whose
effective message-size limit remains below the required threshold, are not affected by this issue. The
demonstrated impact is a crash and interruption of log collection; code execution is not demonstrated.
This issue is fixed in version 8.2606.0. (CVE-2026-61548)
- A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the
RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises
from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful
exploitation can lead to a denial of service (DoS) for the affected system. (CVE-2026-78002)
Solution
Update the rsyslog library and its related packages to version 8.2608.0-r0 or later.See Also
https://security.alpinelinux.org/vuln/CVE-2026-19654
https://security.alpinelinux.org/vuln/CVE-2026-55556
https://security.alpinelinux.org/vuln/CVE-2026-61548
Plugin Details
Severity: High
ID: 478598
Version: Revision 1.1
Type: Local
Published: 11/6/2026
Updated: 11/6/2026
Supported Sensors: Agentless Assessment
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 93.13
CVSS v2
Risk Factor: High
Base Score: 7.6
Temporal Score: 5.6
Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2026-61548
CVSS v3
Risk Factor: High
Base Score: 8.1
Temporal Score: 7.1
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 8.2
Threat Score: 4.6
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score Source: CVE-2026-55556
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 7/6/2026
Reference Information
CVE: CVE-2026-19654, CVE-2026-55556, CVE-2026-61548, CVE-2026-78002, CVE-2026-93403
IAVA: 2026-A-0775-S, 2026-A-0983