CVE-2026-78002: Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function
A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript replace() function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.
Other sources
doFuncReplace() in grammar/rainerscript.c implements replace(source, find, replaceWith) as two passes over the source string: pass 1 computes the output length, pass 2 allocates that many bytes with esnewStr() and fills them. On partial-match failure the two passes rewind by different amounts — pass 1 does i -= (j - 1), pass 2 does i -= j — so pass 1 resumes scanning at matchStart + 2 while pass 2 resumes at matchStart + 1. Every match that begins one byte after a failed partial match is therefore counted by pass 2 but not by pass 1. When replaceWith is longer than find, each such match makes the allocation short by lReplaceWith - lfind bytes, and pass 2 writes past the end of the buffer. Neither store site is bounds-checked. The source string is normally a message property ($msg, $rawmsg, …), so an unauthenticated remote syslog sender chooses the number of missed matches and thus the size of the overflow.
— Red Hat
Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.2308.0-7 - Upgrade
Upgrade
debian/rsyslogto a version that resolves this vulnerability.Fixed in 8.2504.0-1+deb13u2Fixed in 8.2608.0-4
Event History
Frequently Asked Questions
What must an attacker be able to do to trigger the flaw?
The attacker must be able to send specially crafted syslog messages to the affected rsyslog instance. No authentication or user interaction is required.
Which configurations are exposed?
Exposure requires use of the RainerScript replace() function on attacker-influenced message content, such as message properties including $msg or $rawmsg. The overflow occurs when a failed partial match is followed one byte later by a match that is replaced with a string longer than the search string.
What is the expected impact of successful exploitation?
Successful exploitation can corrupt heap memory and cause a denial of service for the affected system. The provided information describes availability impact, not confidentiality or integrity impact.