CVE-2026-19654: Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd
A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd. The issue is not active in a default installation. Exploitation requires all of the following:
imptcp is explicitly loaded. An imptcp listener uses the non-default framing.delimiter.regex mode. An attacker can establish a TCP connection to that listener.
A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.
Other sources
A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19654?
CVE-2026-19654 has a severity rating of high, with a score of 7.5.
How do I fix CVE-2026-19654?
To fix CVE-2026-19654, it is recommended to apply the latest updates to the rsyslog software that address this vulnerability.
What impact does CVE-2026-19654 have on my system?
CVE-2026-19654 can cause rsyslogd to crash due to a crafted input sequence, but it does not affect confidentiality or integrity.
Is CVE-2026-19654 exploitable by authenticated users?
No, CVE-2026-19654 can be exploited by unauthenticated remote peers.
Which module is affected by CVE-2026-19654?
The vulnerability in CVE-2026-19654 specifically affects the optional imptcp input module of rsyslog.