CVE-2026-19654
published 2026-08-12CVE-2026-19654: A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery…
PriorityP347high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.56%
46.6th percentile
A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| rsyslog | rsyslog | — | — |
| rsyslog | rsyslog | >= 8.36.0 < 8.2608.0 | 8.2608.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd
vendor_redhat·2026-07-22·CVSS 7.5
CVE-2026-19654 [HIGH] CWE-125 rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd
rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd
A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.
A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact,
VulDB
rsyslog imptcp input validation
vuldb·2026-08-12·CVSS 7.5
CVE-2026-19654 [HIGH] rsyslog imptcp input validation
A vulnerability categorized as critical has been discovered in rsyslog. This impacts an unknown function of the component imptcp. Such manipulation leads to improper input validation.
This vulnerability is uniquely identified as CVE-2026-19654. The attack can be launched remotely. No exploit exists.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://access.redhat.com/errata/RHSA-2026:66405https://access.redhat.com/errata/RHSA-2026:67583https://access.redhat.com/errata/RHSA-2026:67584https://access.redhat.com/errata/RHSA-2026:71603https://access.redhat.com/errata/RHSA-2026:80817https://access.redhat.com/errata/RHSA-2026:84571https://access.redhat.com/errata/RHSA-2026:84576https://access.redhat.com/errata/RHSA-2026:86124https://access.redhat.com/errata/RHSA-2026:87408https://access.redhat.com/security/cve/CVE-2026-19654https://bugzilla.redhat.com/show_bug.cgi?id=2502868https://github.com/rsyslog/rsyslog/security/advisories/GHSA-cj5r-wh2m-7w29
2026-08-12
Published