SUSE-SU-2026:5082-1: Security update for rsyslog
This update for rsyslog fixes the following issues:
- CVE-2026-92709: omfile dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling, which can lead to arbitrary code execution (bsc#1286926). - RainerScript replace() length wrap (bsc#1285036).
Other sources
This update for rsyslog fixes the following issues: CVE-2026-92709: omfile dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling, which can lead to arbitrary code execution (bsc#1286926). RainerScript replace() length wrap (bsc#1285036).
— SUSE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/rsyslogto a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade
suse/rsyslog-debugsourceto a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade
suse/rsyslog-debuginfoto a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade
suse/rsyslog-module-osslto a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade
suse/rsyslog-module-ossl-debuginfoto a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade
suse/rsyslog-module-mmnormalizeto a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade
suse/rsyslog-module-relpto a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade
suse/rsyslog-module-udpspoofto a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade
suse/rsyslog-module-mmnormalize-debuginfoto a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade
suse/rsyslog-module-gtls-debuginfoto a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade
suse/rsyslog-module-udpspoof-debuginfoto a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade
suse/rsyslog-module-gssapi-debuginfoto a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade
suse/rsyslog-module-snmp-debuginfoto a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade
suse/rsyslog-module-relp-debuginfoto a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade
suse/rsyslog-module-pgsql-debuginfoto a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade
suse/rsyslog-module-pgsqlto a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade
suse/rsyslog-module-gtlsto a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade
suse/rsyslog-module-mysql-debuginfoto a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade
suse/rsyslog-module-gssapito a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade
suse/rsyslog-module-mysqlto a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade
suse/rsyslog-module-snmpto a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade
suse/rsyslog-module-kafkato a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade
suse/rsyslog-module-kafka-debuginfoto a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade
suse/rsyslog-develto a version that resolves this vulnerability.Fixed in 8.2608.0-150700.3.29.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Basesystem-15-SP7-2026-5082 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-5082 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Server-Applications-15-SP7-2026-5082 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP7-ERICSSON-2026-5082
Event History
Frequently Asked Questions
Which rsyslog configurations are most exposed to the arbitrary code execution issue?
Deployments using omfile with a dynaFile template are exposed when a path component can be influenced by untrusted input. The issue is the absence of explicit secure-path handling for that template-derived path component.
What attacker capability is required to exploit this issue?
An attacker needs to influence a value that is used as a path component by an omfile dynaFile template. The supplied information does not specify a particular network interface, authentication requirement, or input source.
How can I identify configurations that need urgent review?
Review rsyslog configuration for omfile actions using dynaFile templates, then determine whether any values contributing to the generated path originate from untrusted input. Such configurations should be prioritized because the advisory states they can lead to arbitrary code execution.
Which SUSE product scope is identified by this update?
The update covers rsyslog and related rsyslog packages on SUSE Basesystem Module 15-SP7 and SUSE Server Applications Module 15-SP7 for aarch64, ppc64le, s390x, and x86_64. Listed related packages include rsyslog-module-ossl and rsyslog-module-mmnormalize.