CVE-2026-55556: Rsyslog: Heap buffer overflow in imhttp plugin Basic Authentication handling
Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parseauthheader function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc(0, len) when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes that pointer to aprbase64decode. An unauthenticated remote attacker can send an oversized encoded credential to an imhttp endpoint configured for Basic Authentication, causing decoded data to overwrite adjacent heap memory before credential validation. Deployments that do not install, load, and use imhttp with Basic Authentication are not affected. The demonstrated impact is a process crash that interrupts log collection, and code execution has not been demonstrated. This issue is fixed in version 8.2604.0.
Other sources
Rsyslog: Heap buffer overflow in imhttp plugin Basic Authentication handling
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rsyslog imhttp (Basic Authentication)to a version that resolves this vulnerability.Fixed in 8.2604.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55556?
CVE-2026-55556 is classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-55556?
To fix CVE-2026-55556, update your rsyslog software to the latest version that contains the security patch.
What impact does CVE-2026-55556 have on systems running rsyslog imhttp?
CVE-2026-55556 can lead to a heap overflow, allowing attackers to execute arbitrary code on affected systems.
Is CVE-2026-55556 exploitable over the network?
Yes, CVE-2026-55556 can be exploited remotely due to vulnerable configurations of the rsyslog imhttp module.
When was CVE-2026-55556 published?
CVE-2026-55556 was published on June 23, 2026.