There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A
    crafted input sequence during oversize-frame recovery can cause an invalid internal message length and
    terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has
    been identified. imtcp and the default imptcp framing modes are not affected. (CVE-2026-19654)

  - Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp
    module's parse_auth_header function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with
    calloc(0, len) when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes that
    pointer to apr_base64_decode. An unauthenticated remote attacker can send an oversized encoded credential
    to an imhttp endpoint configured for Basic Authentication, causing decoded data to overwrite adjacent heap
    memory before credential validation. Deployments that do not install, load, and use imhttp with Basic
    Authentication are not affected. The demonstrated impact is a process crash that interrupts log
    collection, and code execution has not been demonstrated. This issue is fixed in version 8.2604.0.
    (CVE-2026-55556)

  - Rsyslog is a rocket-fast system for log processing. From 7.5.4 until 8.2606.0, the optional mmpstrucdata
    plugin's parseSD_PARAM function in plugins/mmpstrucdata/mmpstrucdata.c stores RFC5424 parameter values in
    a fixed pVal[32 * 1024] stack buffer and calls parsePARAM_VALUE without supplying the destination size. A
    remote unauthenticated attacker whose crafted RFC5424 message reaches an action using mmpstrucdata can
    provide a structured-data parameter larger than that buffer when MaxMessageSize permits it, causing an
    attacker-controlled stack overwrite. Deployments that do not install and use the plugin, or whose
    effective message-size limit remains below the required threshold, are not affected by this issue. The
    demonstrated impact is a crash and interruption of log collection; code execution is not demonstrated.
    This issue is fixed in version 8.2606.0. (CVE-2026-61548)

  - A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the
    RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises
    from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful
    exploitation can lead to a denial of service (DoS) for the affected system. (CVE-2026-78002)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp
    module's parse_auth_header function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with
    calloc(0, len) when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes that
    pointer to apr_base64_decode. An unauthenticated remote attacker can send an oversized encoded credential
    to an imhttp endpoint configured for Basic Authentication, causing decoded data to overwrite adjacent heap
    memory before credential validation. Deployments that do not install, load, and use imhttp with Basic
    Authentication are not affected. The demonstrated impact is a process crash that interrupts log
    collection, and code execution has not been demonstrated. This issue is fixed in version 8.2604.0.
    (CVE-2026-55556)

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Rsyslog 是用于日志处理的快速系统。From 8.2110.0 until 8.2604.0，当 HTTP 基本授权值超过其固定的工作缓冲区时，contrib/imhttp/imhttp.c 中可选 imhttp 模块的parse_auth_header函数使用 calloc（0， len） 分配一个零字节堆缓冲区，然后将该指针传递给 apr_base64_decode。未经身份验证的远程攻击者可向针对基本身份验证配置的 imhttp 端点发送特大编码凭据，导致解码数据在凭据验证前覆盖相邻堆内存。不安装、加载和使用具有基本身份验证的 imhttp 的部署不受影响。已证实的影响是进程崩溃会中断日志收集，而且尚未证实代码执行。此问题已在 8.2604.0 版本中修复。
    (CVE-2026-55556)

  - Debian Linux - rsyslog - 无 Ubuntu Linux - [未知描述] （CVE-2026-55556）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - Rsyslog 是一種用於處理記錄的快速系統。From 8.2110.0 until 8.2604.0，當 HTTP Basic Authorization 值超過其固定工作緩衝區時，contrib/imhttp/imhttp.c 中的可選 imhttp 模組的 parse_auth_header 函式會使用 calloc（0， len） 配置零位元組堆緩衝區，然後將該指標傳遞給 apr_base64_decode。未經驗證的遠端攻擊者可將過大的編碼憑證傳送至設定為基本驗證的 imhttp 端點，導致解碼的資料在憑證驗證之前覆寫相鄰的堆積記憶體。未安裝、載入及使用 imhttp 搭配基本驗證的部署不會受到影響。示範的影響是中斷記錄收集的處理程序損毀，而且程式碼執行尚未示範。8.2604.0 版已修正此問題。
    (CVE-2026-55556)

  - Debian Linux - rsyslog - 無 Ubuntu Linux - [不明說明] （CVE-2026-55556）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Rsyslog はログ処理用の高速なシステムです。8.2110.0から8.2604.0まで、contrib/imhttp/imhttp.c のオプションの imhttp モジュールの parse_auth_header 関数は、HTTP Basic Authorization 値が固定された作業バッファを超えると calloc(0, len) でゼロバイトのヒープバッファを割り当て、そのポインターを apr_base64_decode に渡します。認証されていないリモートの攻撃者が、特別に大きいエンコードされた認証情報を Basic 認証用に構成された imhttp エンドポイントに送信し、デコードされたデータが認証情報の検証前に隣接するヒープメモリを上書きする可能性があります。基本認証で imhttp をインストール、ロード、および使用しないデプロイメントは、影響を受けません。実証された影響は、ログ収集を中断するプロセスクラッシュであり、コード実行は実証されていません。この問題はバージョン 8.2604.0 で修正されています。
    (CVE-2026-55556)

  - Debian Linux - rsyslog - なし Ubuntu Linux - [不明な記述](CVE-2026-55556)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp     module's parse_auth_header function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with     calloc(0, len) when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes that     pointer to apr_base64_decode. An unauthenticated remote attacker can send an oversized encoded credential     to an imhttp endpoint configured for Basic Authentication, causing decoded data to overwrite adjacent heap     memory before credential validation. Deployments that do not install, load, and use imhttp with Basic     Authentication are not affected. The demonstrated impact is a process crash that interrupts log     collection, and code execution has not been demonstrated. This issue is fixed in version 8.2604.0.
    (CVE-2026-55556)

  - Debian Linux - rsyslog - None  Ubuntu Linux - [Unknown description] (CVE-2026-55556)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
478598	Alpine: multiple rsyslog packages: security update to 8.2608.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	11/6/2026	11/6/2026	high
474785	Echo: rsyslog: security update to 8.2504.0-1+deb13u2+e1	Tenable Cloud Security	Echo Local Security Checks	10/16/2026	10/16/2026	high
478598	Alpine: multiple rsyslog packages: security update to 8.2608.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	11/6/2026	11/6/2026	high
474785	Echo: rsyslog: security update to 8.2504.0-1+deb13u2+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	10/16/2026	10/16/2026	high
322300	Linux Distros 未修补的漏洞：CVE-2026-55556	Nessus	Misc.	6/24/2026	10/29/2026	high
322300	Linux Distros 未修補弱點：CVE-2026-55556	Nessus	Misc.	6/24/2026	10/29/2026	high
322300	Linux Distros のパッチ未適用の脆弱性: CVE-2026-55556	Nessus	Misc.	6/24/2026	10/29/2026	high
322300	Linux Distros Unpatched Vulnerability : CVE-2026-55556	Nessus	Misc.	6/24/2026	10/29/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high