This update for apache2 fixes the following security issues:

- CVE-2026-106023: modmd NULL pointer dereference leads to child process crash (bsc#1290167). - CVE-2026-109163: modvhostalias 1 byte stack buffer overwrite (bsc#1290169). - CVE-2026-119618: modhttp2: heap corruption and RCE in assignheaders (bsc#1290166).

This update for apache2 fixes the following security issues:

- CVE-2026-106023: modmd NULL pointer dereference leads to child process crash (bsc#1290167). - CVE-2026-109163: modvhostalias 1 byte stack buffer overwrite (bsc#1290169). - CVE-2026-119618: modhttp2: heap corruption and RCE in assignheaders (bsc#1290166).

This update for apache2 fixes the following security issues:

- CVE-2026-106023: modmd NULL pointer dereference leads to child process crash (bsc#1290167). - CVE-2026-109163: modvhostalias 1 byte stack buffer overwrite (bsc#1290169). - CVE-2026-119618: modhttp2: heap corruption and RCE in assignheaders (bsc#1290166).

This update to apache2 version 2.4.71 fixes the following issues:

Security issues fixed:

- CVE-2026-106023: modmd NULL pointer dereference leads to child process crash (bsc#1290167). - CVE-2026-109163: modvhostalias 1 byte stack buffer overwrite (bsc#1290169). - CVE-2026-119618: modhttp2: heap corruption and RCE in assignheaders (bsc#1290166).

Non security issue fixed:

- Severe CPU Usage regression in webserving, from Tumbleweed April to July (bsc#1246913).

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.

A Improper Access Control vulnerability in the kernel of SUSE SUSE Linux Enterprise Server 12 SP5 breaks nftables, causing firewall rules applied via nftables to not be effective.This issue affects SUSE Linux Enterprise Server: from 9e6d9d4601768c75fdb0bad3fbbe636e748939c2 before 9c294edb7085fb91650bc12233495a8974c5ff2d.

This update for python-Pillow fixes the following issues:

- CVE-2026-96636: decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (bsc#1286802). - CVE-2026-96637: decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS (bsc#1286801). - CVE-2026-96638: BMP RLE decoder memory-amplification DoS via unbounded delta escape/absolute mode (bsc#1286800). - CVE-2026-96639: multi-frame loaders can reuse stale native image storage after mode transitions (bsc#1286799). - CVE-2026-96640: PDF append accepts malformed shared page-tree DAG, which can cause resource exhaustion (bsc#1286798). - CVE-2026-96641: reachable undefined behavior in native integer operations can lead to denial of service or logic integrity compromise (bsc#1286797). - CVE-2026-96642: TarIO negative size field causes infinite CPU-spin loop (bsc#1286796). - CVE-2026-96643: PNG eXIf chunk makes EXIF parsing run in quadratic time (bsc#1286795). - CVE-2026-96778: heap buffer overflow writing JPEG comment after ICC profile fills buffer (bsc#1286793). - CVE-2026-112390: Denial of Service via infinite loop during crafted MIC image parsing (bsc#1286256). - CVE-2026-112391: Denial of Service via unbounded recursion in PDF parser (bsc#1286273). - CVE-2026-112392: Denial of Service via zero-size images in rank filters (bsc#1286287). - CVE-2026-112393: heap buffer overflow and stale-heap disclosure in tiffWriteProc when saving compressed TIFF data (bsc#1286325). - CVE-2026-112394: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size (bsc#1286311). - CVE-2026-112395: Pillow tiled-TIFF decoder reads past tile buffer in copy4 (bsc#1286312). - CVE-2026-112396: heap use-after-free when encoding TIFF to an in-memory buffer (bsc#1286313). - CVE-2026-112397: out-of-bounds access in imagingmorph on a zero-width image (bsc#1286314). - CVE-2026-112398: heap buffer overflow in FPX JPEG decoding can lead to code execution (bsc#1286406). - CVE-2026-112399: Denial of service via crafted APNG image (bsc#1286368). - CVE-2026-112400: Denial of Service via memory exhaustion from crafted GIF image (bsc#1286370). - CVE-2026-112401: Denial of Service via crafted GIF comments (bsc#1286372). - CVE-2026-112402: Denial of service via double free during image transformation (bsc#1286381). - CVE-2026-112403: heap buffer overflow in ImagingJpegDecode allows for code execution (bsc#1286405). - CVE-2026-112404: Denial of Service via out-of-bounds read in TIFF decoding (bsc#1286388). - CVE-2026-112405: NULL pointer dereference in Image.merge via an unvalidated band 0 (bsc#1286404). - CVE-2026-112406: infinite loop in PdfParser.rewritepages on page tree Parent cycle (bsc#1286403). - CVE-2026-112891: quadratic GIF comment copying during save (bsc#1286402). - CVE-2026-112892: MSP RLE decoder expands a tiny file into unbounded memory (bsc#1286401). - CVE-2026-112893: Denial of Service via invalid pointer free during font rendering (bsc#1286392). - CVE-2026-112894: Denial of Service via crafted multi-frame image conversion (bsc#1286408). - CVE-2026-112895: Denial of service via crafted PDF during append operations (bsc#1286411). - CVE-2026-112896: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read (bsc#1286400). - CVE-2026-112897: TiffDecode returns uninitialized memory as pixels for short JPEG strips (bsc#1286398). - CVE-2026-112898: Image.quantize() with empty palette can leak uninitialized stack memory (bsc#1286399). - CVE-2026-112899: EPS load(scale) lets Ghostscript render past the decompression bomb limit (bsc#1286489). - CVE-2026-112900: argument Injection in Ghostscript call can lead to remote code execution (bsc#1286397). - CVE-2026-112901: ReDoS in XbmImagePlugin can be triggered by 512-byte file (bsc#1286396). - CVE-2026-112902: memory disclosure and segfault in libtiff encoder via crafted TIFF tags (bsc#1286804). - CVE-2026-114501: Arrow export leaks stale heap memory when PILLOWALIGNMENT > 1 (bsc#1286803).

This update for python-Pillow fixes the following issues:

- CVE-2026-96636: decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (bsc#1286802). - CVE-2026-96637: decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS (bsc#1286801). - CVE-2026-96638: BMP RLE decoder memory-amplification DoS via unbounded delta escape/absolute mode (bsc#1286800). - CVE-2026-96640: PDF append accepts malformed shared page-tree DAG, which can cause resource exhaustion (bsc#1286798). - CVE-2026-96641: reachable undefined behavior in native integer operations can lead to denial of service or logic integrity compromise (bsc#1286797). - CVE-2026-96642: TarIO negative size field causes infinite CPU-spin loop (bsc#1286796). - CVE-2026-96778: heap buffer overflow writing JPEG comment after ICC profile fills buffer (bsc#1286793). - CVE-2026-112390: Denial of Service via infinite loop during crafted MIC image parsing (bsc#1286256). - CVE-2026-112391: Denial of Service via unbounded recursion in PDF parser (bsc#1286273). - CVE-2026-112392: Denial of Service via zero-size images in rank filters (bsc#1286287). - CVE-2026-112393: heap buffer overflow and stale-heap disclosure in tiffWriteProc when saving compressed TIFF data (bsc#1286325). - CVE-2026-112394: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size (bsc#1286311). - CVE-2026-112395: Pillow tiled-TIFF decoder reads past tile buffer in copy4 (bsc#1286312). - CVE-2026-112397: out-of-bounds access in imagingmorph on a zero-width image (bsc#1286314). - CVE-2026-112398: heap buffer overflow in FPX JPEG decoding can lead to code execution (bsc#1286406). - CVE-2026-112399: Denial of service via crafted APNG image (bsc#1286368). - CVE-2026-112400: Denial of Service via memory exhaustion from crafted GIF image (bsc#1286370). - CVE-2026-112401: Denial of Service via crafted GIF comments (bsc#1286372). - CVE-2026-112402: Denial of service via double free during image transformation (bsc#1286381). - CVE-2026-112403: heap buffer overflow in ImagingJpegDecode allows for code execution (bsc#1286405). - CVE-2026-112404: Denial of Service via out-of-bounds read in TIFF decoding (bsc#1286388). - CVE-2026-112405: NULL pointer dereference in Image.merge via an unvalidated band 0 (bsc#1286404). - CVE-2026-112406: infinite loop in PdfParser.rewritepages on page tree Parent cycle (bsc#1286403). - CVE-2026-112891: quadratic GIF comment copying during save (bsc#1286402). - CVE-2026-112892: MSP RLE decoder expands a tiny file into unbounded memory (bsc#1286401). - CVE-2026-112894: Denial of Service via crafted multi-frame image conversion (bsc#1286408). - CVE-2026-112895: Denial of service via crafted PDF during append operations (bsc#1286411). - CVE-2026-112896: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read (bsc#1286400). - CVE-2026-112897: TiffDecode returns uninitialized memory as pixels for short JPEG strips (bsc#1286398). - CVE-2026-112898: Image.quantize() with empty palette can leak uninitialized stack memory (bsc#1286399). - CVE-2026-112899: EPS load(scale) lets Ghostscript render past the decompression bomb limit (bsc#1286489). - CVE-2026-112900: argument Injection in Ghostscript call can lead to remote code execution (bsc#1286397). - CVE-2026-112901: ReDoS in XbmImagePlugin can be triggered by 512-byte file (bsc#1286396). - CVE-2026-112902: memory disclosure and segfault in libtiff encoder via crafted TIFF tags (bsc#1286804).

Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.75 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

An out-of-bounds read flaw was found in the way Expat processed certain input. A remote attacker could send specially crafted XML that, when parsed by an application using the Expat library, would cause that application to crash or, possibly, execute arbitrary code with the permission of the user running the application.

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.

This update for rsyslog fixes the following issues:

- CVE-2026-19654: imptcp regex-framing remote denial of service (bsc#1271910). - CVE-2026-61548: crafted RFC 5424 messages to mmpstrucdata can lead to a stack overwrite (bsc#1272414). - CVE-2026-78002: RainerScript replace() heap buffer overflow (bsc#1275926). - CVE-2026-92709: omfile dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling, which can lead to arbitrary code execution (bsc#1286926). - RainerScript replace() length wrap (bsc#1285036).

Changes for rsyslog:

- added new rsyslog (imdtls/omdtls) DTLS modules (jsc#PED-16623) - upgrade to rsyslog 8.2608.0 (bsc#1257604) 2026-08-18: imbeats: rearm listener after failed TLS accept 2026-08-18: msg: serialize turbo snapshot duplication 2026-08-18: omfile: harden dynafile default containment 2026-08-18: fixup! omfwd: support PKCS#11 URIs with ossl TLS 2026-07-02: omfwd: support PKCS#11 URIs with ossl TLS 2026-07-21: mmkubernetes: reload SA token proactively and on HTTP 401 2026-08-17: devtools: remove Cubic from local validation 2026-08-14: mmnormalize: share turbo $! snapshot across MsgDup by refcount 2026-08-11: tcpsrv: synchronize session table slots 2026-08-11: imrelp: preserve errno across stop signal 2026-08-12: examples.rst: Missing space in template 2026-08-10: mmnormalize: merge debug metadata 2026-08-08: normalizers: complete debug test gating 2026-08-08: normalizers: complete debug integration 2026-08-07: mmnormalize, pmnormalize: add liblognorm debugging 2026-08-07: msg: ignore null values in msgSetPropViaJSON() instead of crashing 2026-08-07: runtime: make error-message flag atomic 2026-07-24: fuzz: exercise RFC 3164 and RFC 5424 parsers 2026-08-05: build: unify indentation in ACCONFIGFILES list 2026-07-25: imfile: fix delay.message microsecond conversion 2026-07-24: diskqueue: reject symlinked persisted segments 2026-06-23: omfile: control symlink following 2026-07-25: mmnormalize: make HUP reload worker-safe 2026-07-24: docs(agents): add Cursor Cloud environment setup notes 2026-07-22: imbeats: harden Lumberjack input resource handling 2026-07-23: stringbuf: harden empty string replacement 2026-07-20: imptcp: guard regex framing match at line start (CVE-2026-19654 bsc#1271910) 2026-07-21: rainerscript: free cnfstmtNewAct nvlst once, at the done: label 2026-07-21: queue: preserve DA child work during shutdown 2026-07-21: imtcp: release completed zlib decoder state 2026-07-09: doc: clarify JSON array rendering 2026-07-21: Potential fixes for 5 code quality findings (#7397) 2026-07-20: ratelimit: optimize port-based per-source keys 2026-07-20: imtcp: make zstd window budget configurable 2026-07-19: imtcp: use snake case for zstd window tracking 2026-07-17: imtcp: bound aggregate zstd decoder window memory 2026-07-20: statsobj: guard Prometheus escape writes 2026-07-18: config: do not instantiate actions disabled via config.enabled="off" 2026-07-15: queue: document DA engine internals 2026-07-14: msg: enforce source-property helper contract 2026-07-10: ratelimit: remove per-source key policy hot lock 2026-07-08: ratelimit: speed source-key shortcuts 2026-07-15: queue: clarify DA transfer worker role 2026-07-18: compatqueue: add missing STAILQFOREACH/STAILQNEXT fallback 2026-07-18: rainerscript: warn on constant AND/OR operand at parse time 2026-07-18: configure: include <stddef.h> in the STAILQ detection test 2026-07-17: mmnormalize: share Turbo CEE root path check 2026-07-17: mmnormalize: fall back after Turbo materialization failure 2026-07-17: mmnormalize: preserve turbo results across message boundaries 2026-07-17: benchmarks: harden comparison and helper inputs 2026-07-16: segdisk: optimize CRC accounting and add benchmarks 2026-07-15: imjournal: stop invalidation reopen busy-loop 2026-07-14: queue: harden segmented DA lifecycle invariants 2026-07-14: queue: harden DA portability and startup cleanup 2026-07-14: queue: address segmented DA review findings 2026-07-14: queue: stabilize DA shutdown and reload state 2026-07-14: queue: clarify lazy marker and legacy state paths 2026-07-14: queue: gate idle cleanup on durable intent 2026-07-14: queue: document empty DA marker replacement 2026-07-14: queue: preserve classic state on transient load errors 2026-07-14: queue: make idle cleanup restoration crash safe 2026-07-14: queue: fail classic DA startup on real errors 2026-07-14: queue: clarify dirty DA configuration handling 2026-07-14: queue: separate DA idle and worker timeouts 2026-07-14: queue: document DA auto-upgrade boundary 2026-07-14: queue: publish fresh DA markers on first spill 2026-07-14: queue: constrain classic DA startup fallback 2026-07-14: queue: clarify disabled DA idle timeout 2026-07-14: queue: preserve classic DA startup fallback 2026-07-14: doc: describe segmented disk-assisted queues 2026-07-14: queue: add segmented disk-assisted engine 2026-07-14: queue: retain adopted recovery frontier 2026-07-14: queue: address segmented disk review findings 2026-07-13: queue: wake workers before capacity waits 2026-07-13: queue: make segmented deletion resumable 2026-07-13: queue: initialize missing state in empty spool dirs 2026-07-13: queue: reject invalid segmented codec field types 2026-07-13: queue: avoid sanitized generation wrap 2026-07-13: queue: expose segmented disk durability test hooks 2026-07-13: queue: make segmented disk recovery lazy 2026-07-09: queue: rework experimental segmented disk backend 2026-07-08: imjournal: warn when failing to get the MESSAGE field 2026-07-08: omawslogshlc: add CloudWatch Logs HLC output module 2026-07-08: core: add systemd READY delay opt-in 2026-06-02: core/imfile: synchronize sdnotify READY=1 with module startup 2026-07-07: ratelimit: shard per-source state 2026-07-06: docs: validate marked config samples 2026-07-07: ratelimit: shard named config registry 2026-07-06: runtime: harden ratelimit per-source reload 2026-07-06: queue: align legacy action batch default 2026-07-06: runtime: relax worker-count log reads 2026-07-06: core: relax selected atomic flag reads 2026-07-06: omkafka: relax poll stop flag atomics 2026-07-06: doc: add documentation for imfile delay.message parameter 2026-06-04: core: add generic output rate limiting 2026-07-05: omelasticsearch: apply TLS options during detection 2026-06-24: omprog: pace transaction retry resumes 2026-07-02: runtime: add relaxed 32-bit atomic helpers 2026-07-02: runtime: fix uint64 atomic fallback return 2026-07-02: net: match legacy allowed sender hostname handling 2026-07-02: runtime: modernize atomic helper usage 2026-07-02: net: add modern allowedSender ACLs 2026-07-02: queue: keep DA child workers alive while idle 2026-07-01: runtime: add atomic read load helpers 2026-07-01: rainerscript: align hex escape lexer states 2026-06-30: rainerscript: accept hex object string escapes 2026-06-30: runtime: synchronize action retry shutdown state 2026-06-30: mmutf8fix: fix replacement sequence examples 2026-06-16: parser: preserve first sanitize offset with SpaceLF 2026-06-29: template: avoid new legacy octal escape 2026-06-29: Make imptcp-epoll-add-failure.sh Linux-only 2026-06-29: Use checkLTLIBRARIES to generate liboverride test libraries 2026-06-29: doc: correct tcpusertimeout version marker 2026-06-23: omhttp: continue after permanent data failures 2026-06-28: ommail: harden subject template header output 2026-06-28: omprog/omstdout: guard empty template LF checks 2026-06-23: tcp: skip legacy z after stream decode 2026-06-26: omelasticsearch: escape bulk metadata values 2026-06-24: imtcp: bound zstd decoder window 2026-06-24: mmkubernetes: add kubernetesurl failover 2026-06-26: docs: add v8-stable patch-flow skill to stable branch 2026-06-26: impcap: bound-check ARP address lengths 2026-06-26: Initialize devcontainer option state 2026-06-26: Remove obsolete Ubuntu 18.04 dev containers 2026-06-26: Refresh dev container cleanup 2026-06-26: agent: add v8-stable patch flow skill 2026-06-26: ChangeLog: split include-glob follow-up 2026-06-26: config: keep empty include globs silent 2026-06-26: gtls: harden DNS SAN byte handling 2026-06-25: Codify timeoutGuard testbench invariant 2026-06-26: imhttp: enforce gzip request body limit 2026-06-24: imhttp: defensive fixes and auth fallback correction 2026-06-25: doc/release: prevent invalid release version manual change 2026-06-24: omelasticsearch: add tls.tlsversion, tls.ciphersuites, tls.keyexchangegroups 2026-06-24: input: warn for rulesets without queues 2026-06-24: ommongodb: preserve ISODate fractional seconds 2026-06-24: imuxsock: clarify missing Socket diagnostics 2026-06-24: rsyslogd: reject -o output over input config 2026-06-24: template: add timereceived property alias 2026-06-24: imudp: store received sockaddr length 2026-06-23: imfile: warn on duplicate file monitors 2026-06-24: omudpspoof: stop retrying failed fragments 2026-06-23: gtls: guard early debug-level lookup (bsc#1274610) 2026-06-23: statsobj: handle lock control failures 2026-06-23: build: avoid empty usertools install dirs 2026-06-23: imdocker: recover from stale since anchors 2026-06-23: tcpflood: add GnuTLS priority string option 2026-06-23: imjournal: add journal namespace support 2026-06-23: prepare for next scheduled stable release cycle 2026-06-23: doc: clarify omprog transaction mode status 2026-06-23: errmsg: enrich oversize errorfile records 2026-06-23: omelasticsearch: retry read-only bulk failures 2026-06-23: doc: clarify fromhost case handling 2026-06-23: doc: clarify ommysql data failures 2026-06-23: omuxsock: isolate action socket locks 2026-06-16: template: add octal control character escape 2026-06-16: omfwd: add TCP user timeout action option 2026-06-15: mmutf8fix: support replacement sequences 2026-06-09: [Modernization] Replace Internal Backticks with Shell Expansion: Rscript Batch 1 2026-06-08: diag.sh: fix content-pattern-check and assert-first-column-sum-greater-than 2026-06-23: imtcp: add stream compression support 2026-06-23: docs: add queue-full troubleshooting 2026-06-22: mmpstrucdata: document structured-data buffer invariant 2026-06-21: doc: refine object terminator wording 2026-06-21: doc: clarify security release handling 2026-06-21: doc: clarify RainerScript semicolon use 2026-06-20: rainerscript: escape embedded NULs at C-string boundary 2026-06-20: doc: explain service sandboxing for helpers 2026-06-20: doc: address service sandboxing review 2026-06-20: Apply suggested fix to tools/pmrfc3164.c from Copilot Autofix 2026-06-19: rainerscript: fold constant comparisons 2026-06-18: doc: clarify partial config validation 2026-06-18: config: warn on constant boolean operands 2026-06-17: parser: honor parseHostnameAndTag in RFC3164 parser 2026-06-17: core: fix negated exact priority filters 2026-06-16: rainerscript: keep random result non-negative 2026-06-16: rainerscript: add cbool function 2026-06-16: pmrfc3164: honor parseHostnameAndTag at runtime 2026-06-16: msg: invalidate programname when tag changes 2026-06-16: imfile: deliver same-file monitors independently 2026-06-16: glbl: keep debug logfile notice informational 2026-06-16: doc: modernize GELF forwarding tutorial 2026-06-15: ommail: add SMTP mode test 2026-06-15: mmjsonparse: modernize test output paths 2026-06-14: parser: add optional trailing CR stripping 2026-06-14: ompgsql: accept long server hostnames 2026-06-14: dynstats: warn on duplicate bucket names 2026-06-14: action: warn on duplicate action names 2026-06-13: omfwd: use matching atomic mutex helper 2026-06-08: Merge pull request #7014 from rsyslog/cursor/critical-correctness-bugs-480c 2026-06-05: omazureeventhubs docs: fix underscored parameters 2026-06-04: runtime: fix YAML promotion OOM ownership 2026-06-04: omuxsock docs: correct template parameter 2026-06-04: omhttp: own Splunk profile template names 2026-06-04: mmjsonparse: reject boundary trailing data 2026-06-04: mmdblookup: preserve uint64 values 2026-06-04: mmdblookup: check uint64 fallback formatting 2026-06-04: impstats docs: fix dotted log parameters 2026-06-04: impstats docs: clarify parameter name guidance 2026-06-04: imkafka: stop workers on startup failure 2026-06-04: imkafka: refine startup stop flag handling 2026-06-04: doc: match Sphinx duplicate CLI override handling 2026-06-04: doc: keep stable git docs out of dev mode 2026-06-04: doc: format stable rstprolog metadata 2026-06-04: doc: fix database tutorial SQL template option 2026-06-03: regexp: avoid per-thread shutdown double-free 2026-06-03: omkafka: fix NULL topic and add action name to onDestroy flush logs 2026-06-03: mmsnareparse: honor searchWindow in tabbed trailing scan 2026-06-03: mmsnareparse: cap tab trailing search by token 2026-06-03: imfifo: guard absent module config paths 2026-06-03: imfifo: bind instances to module config 2026-06-03: imdiag: fix stats reporting gate 2026-06-03: imdiag: avoid checked cond signal while locked 2026-06-03: docker: gate collector imtcp module 2026-06-03: docker: derive single imtcp enable switch 2026-06-03: docker: default derived imtcp switch in collector 2026-06-02: yamlconf: clean up include recursion guard 2026-06-02: tls: propagate wolfSSL send-side read retry 2026-06-02: tls: keep wolfSSL send retry local 2026-06-02: tls: bound wolfSSL send-side read retries 2026-06-02: sidecar: cap UDP burst buffer by total bytes 2026-06-02: runtime: include limits.h for INTMAX in yamlconf 2026-06-02: runtime: guard against recursive YAML includes 2026-06-02: runtime/queue: reset sizeOnDisk after safe recovery 2026-06-02: rainerscript: accept optimizer NOP statements 2026-06-02: omkafka: fix HUP deadlock when doAction holds mutdoAction (#7129) 2026-06-02: omhttp: avoid retry-ruleset self-stall 2026-06-02: omhiredis: fix TLS context error log 2026-06-02: mmpstrucdata: support custom SD containers (CVE-2026-61548 bsc#1272414) 2026-06-02: mmjsonparse: fix find-json ownership and scan bounds 2026-06-02: mmjsonparse: clear JSON pointer after ownership transfer 2026-06-02: devtools: fold local review experiment into planner 2026-06-01: translate: cover script serialization (#7152) 2026-06-01: devenv: include lcov in Ubuntu coverage images 2026-06-01: ChangeLog: update 8.2606 entries 2026-06-01: Add parsetimelocaltz with documentation 2026-05-31: runtime: join final worker after shutdown wait 2026-05-31: runtime: harden raw message replacement growth 2026-05-31: runtime: fix $!all-json serialization locking 2026-05-31: ratelimit: centralize per-source enforcement 2026-05-31: parser: fix NetAddr cleanup on mask parse errors 2026-05-31: omclickhouse: report HTTP response errors 2026-05-31: omclickhouse: document SQL template option 2026-05-31: omclickhouse: clean up JSON root on OOM 2026-05-31: action: avoid committing suspended retry batches 2026-05-31: Keep transactional action queue messages on shutdown 2026-05-30: rainerscript: add tocef() and cefextescape() for CEF output 2026-05-30: doc: clarify queue crash durability limits 2026-05-30: devtools: add read-only C format check 2026-05-29: tls: propagate send-side receive retry 2026-05-29: tls: preserve send-side receive retry state 2026-05-29: tls: preserve send retry without reconnect 2026-05-29: tls: keep wolfSSL send-side retry local 2026-05-29: tls: keep send-side read retries local 2026-05-29: template: apply style-check formatting 2026-05-29: style: format msg replacement tests 2026-05-29: runtime: fix msg replace helper CI failures 2026-05-29: omkafka: fix suspension not triggered on host resolution failure 2026-05-29: omfwd: schedule retry for deferred TCP flush 2026-05-29: omfwd: preserve connection on retryable TLS sends 2026-05-29: omfwd: avoid tcpclt leak on rebind 2026-05-29: mmsnareparse: preserve regex end-anchor semantics 2026-05-29: imudp: validate listen port formatting 2026-05-29: imudp: harden listen port file writes 2026-05-29: imptcp: simplify compression auto probe 2026-05-29: imkafka: support multiple topics in one input() instance 2026-05-29: imjournal: warn when newest entry is in the future 2026-05-29: imjournal: handle clock jumps in future probe 2026-05-29: docs: strengthen GHSA prompt guardrails 2026-05-29: add func doFunctParseTimeLocalTz 2026-05-29: Update doc/security/ghsa-coordination-review-template.md 2026-05-29: Fix rawmsg suffix shift on realloc 2026-05-29: Fix msg replacement and JSON set handling 2026-05-29: Apply suggested fix to tests/mmexternal-response-too-long.sh from Copilot Autofix 2026-05-28: tls: keep send retry state internal 2026-05-28: template: reject invalid regex match selectors 2026-05-28: template: guard NULL property rendering 2026-05-28: packaging: use ETL Vespa env defaults directly 2026-05-28: packaging: default ETL TLS envs in entrypoint 2026-05-28: omelasticsearch: apply clang-format to version probe error 2026-05-28: mmjsontransform: fix dotted conflict ownership 2026-05-28: mmexternal: fix single-instance reply handling 2026-05-28: mmexternal: fix EINTR reply handling 2026-05-28: mmdblookup: clean up failed worker creation 2026-05-28: imuxsock: handle embedded NUL datagrams safely 2026-05-28: imptcp: harden auto compression probe 2026-05-27: tls: preserve recv data during send-side reads 2026-05-27: tls: avoid recv-helper misuse in send WANTREAD 2026-05-27: tls: avoid receive retry state during send 2026-05-27: template: fix jsonftree flat fallback framing 2026-05-27: runtime: reject embedded NULs in mbedtls cert names 2026-05-27: runtime: initialize ratelimit mutex once 2026-05-27: runtime: guard per-thread regexp iterator allocation 2026-05-27: runtime: fix fromhost-port extraction before rcvFrom union swap 2026-05-27: runtime: clean up DNS props on port allocation failure 2026-05-27: runtime-format-regexp-lifecycle-guards 2026-05-27: regexp-clean-up-per-thread-entries 2026-05-27: packaging: expose Vespa HTTPS toggles 2026-05-27: packaging: enable HTTPS by default for ETL Vespa output 2026-05-27: omusrmsg: enable thread-safe action ratelimiter 2026-05-27: omotel: use getProgramName() when deriving app name 2026-05-27: omotel: avoid const cast for app name extraction 2026-05-27: ommysql: handle closed connection before commit 2026-05-27: omkafka: harden failed delivery replay paths 2026-05-27: omhttp: refresh health-check headers after gzip rebuild 2026-05-27: omhttp: keep health-check headers uncompressed 2026-05-27: omelasticsearch: bound startup version probe response size 2026-05-27: mmsnareparse: skip full digit runs in event probe 2026-05-27: mmsnareparse: preserve anchored trailing regex matches 2026-05-27: mmsnareparse: cap regex input in trailing token 2026-05-27: mmsnareparse: avoid quadratic provider scans in snare probe 2026-05-27: mmjsontransform: fix child ownership on dotted merge conflicts 2026-05-27: mmjsontransform: clean up dotted insert ownership 2026-05-27: mmanon: remove assert on malformed embedded IPv4 2026-05-27: mmanon: make random suffix generation fully reachable 2026-05-27: mmanon: build random suffix from byte chunks 2026-05-27: mbedtls-refine-nul-name-checks 2026-05-27: mbedtls-apply-cert-name-style 2026-05-27: lookup: report active table reloads as pending 2026-05-27: lmsig-ksi-bound-debug-precision 2026-05-27: imptcp: serialize helper work per session 2026-05-27: imptcp: add stream:auto compression mode 2026-05-27: imfifo: implement named pipe input module (#7029) 2026-05-27: dynstats: coalesce pending persistence writes per bucket 2026-05-27: dynstats-unlock-on-task-alloc-failure 2026-05-27: docker: fix clickhouse configure flag in Debian 13 dev image 2026-05-27: doc: use literal markup for TLS parameters 2026-05-27: doc: fix shutdown.enable.ctlc spelling in rsyslogd man page 2026-05-27: doc: fix mmrfc5424addhmac sdid parameter name 2026-05-27: doc: clarify mbedtls requires StreamDriverMode=1 for TLS 2026-05-27: configure: detect relpCltSetKeepAlive support 2026-05-26: stats: avoid notifier teardown deadlocks 2026-05-26: runtime: guard optional regexp object lifecycle in tcp server 2026-05-26: runtime: bound KSI debug record logging by length 2026-05-26: runtime: avoid regexp unload double free 2026-05-26: ratelimit: avoid double free on helper error paths 2026-05-26: perctile: reuse counter cleanup helper 2026-05-26: perctile: link buckets after initialization 2026-05-26: ossl: avoid caching OCSP responses past nextUpdate 2026-05-26: omazuredce: bound HTTP response buffering 2026-05-26: omazuredce: avoid gzip buffer underallocation 2026-05-26: omazuredce-review-followup 2026-05-26: imuxsock: enforce ratelimit.name for credentialed senders 2026-05-26: imuxsock-ratelimit-credential-followup 2026-05-26: impstats: fix double-free in remote write batching cleanup 2026-05-26: imkafka: cap split.json.records fan-out 2026-05-26: imdocker: keep stream alive on rate-limit drops 2026-05-26: imdocker: bound multiline segment compaction 2026-05-26: imdocker: apply clang-format output 2026-05-26: configure: avoid leaking -lgcrypt into global LIBS 2026-05-25: shellcheck: fix masked test assignments 2026-05-25: runtime: validate numeric hardening inputs 2026-05-25: runtime/nsdgtls: validate IP SAN length before conversion 2026-05-25: parser: verify and fix offAfterPRI calculation 2026-05-25: omhiredis: derive TLS server name from server config 2026-05-25: omfwd: require peers for targetSrv TLS name auth 2026-05-25: omfwd: clarify targetSrv TLS auth error 2026-05-25: nsdgtls: preserve SAN-present state for malformed IP SAN 2026-05-25: imhttp: write bound listener port to file 2026-05-25: imdtls: write bound listener port to file 2026-05-25: fix(imhiredis): default TLS peer name to configured server 2026-05-24: tools: make AIX SRC reply copy bounded 2026-05-24: statsobj: clear lock flag after prometheus unlock 2026-05-24: runtime: clamp emulated RFC5424 tag length 2026-05-24: runtime: avoid post-fork malloc in execProg 2026-05-24: runtime/statsobj: lock stats list during iteration 2026-05-24: nsdmbedtls: reject RemoteSNI and wire interface 2026-05-24: nsdmbedtls: fill remote port interface methods 2026-05-24: mmjsontransform: track per-insert conflicts 2026-05-24: mmjsontransform: avoid leak on policy insert conflict 2026-05-24: mmjsonparse: avoid json double-free on add failure 2026-05-24: mmexternal: avoid undrained stdout/stderr pipe in output=none mode 2026-05-24: mmexternal: address output pipe review findings 2026-05-24: impstats: harden overwrite temp file creation 2026-05-24: imjournal: treat rate-limit discards as non-fatal in readjournal 2026-05-24: gssapi: use uint32t for token wire length 2026-05-24: gssapi: fix token length framing endianness in sender 2026-05-24: fix(tools): guard AIX SRC reply text against NULL 2026-05-23: rainerscript: fix array and numeric comparisons on JSON vars 2026-05-23: privdrop: update privilege drop comments 2026-05-23: privdrop: log capability context on drop failure 2026-05-23: omelasticsearch: guard dynamic template strings 2026-05-23: omelasticsearch: cache action template count 2026-05-23: imjournal: restore cursor after recovery reopen 2026-05-23: imjournal: recover from stale saved cursor 2026-05-23: imjournal: harden journal invalidation recovery 2026-05-23: imjournal: avoid rotation accounting during recovery 2026-05-23: docs: clarify local validation gates 2026-05-23: contrib, runtime: defensive stability and robustness hardening 2026-05-23: codex: wire local container testing hook into agent workflow 2026-05-22: shell: clean up ShellCheck findings 2026-05-22: python: clean up style and add optional checks 2026-05-22: netossl: document SAN-priority hard-stop on old API 2026-05-22: msg: guard MSG replacement offsets (bsc#1272414) 2026-05-22: mmexternal: support one-way helpers and response timeouts 2026-05-22: imptcp: unlink failed accepted sessions 2026-05-22: imjournal: fix double-free hazards on JSON objects 2026-05-22: imfile: add line-number metadata and soften empty checks 2026-05-22: imdocker: terminate compacted multiline buffers 2026-05-22: imbeats: harden pointer transfer in submitEvent 2026-05-22: contrib, plugins: refine pointer hand-off in imhiredis, mmjsonparse, mmsequence 2026-05-22: contrib, plugins: defensive pointer hand-off hardening 2026-05-22: config: warn for unmatched include globs 2026-05-22: agents: document optional local linters 2026-05-21: template: harden property rendering bounds 2026-05-21: tcpsrv: guard listener destructors against NULL references 2026-05-21: tcpssess: secure regex memory reallocation and destructor 2026-05-21: style: format wolfSSL CRL helper 2026-05-21: ruleset: guard synchronous recursive calls 2026-05-21: rainerscript: harden string and JSON bounds 2026-05-21: pm/fm: defensively harden parsing edge cases 2026-05-21: ossl: enable wolfSSL CRL checks for DER files 2026-05-21: netossl: avoid CN fallback when SAN priority unsupported 2026-05-21: mmgrok: keep configured source immutable 2026-05-21: lookup: harden shutdown lifecycle 2026-05-21: imudp: harden thread lifecycles and fix stats memory leak 2026-05-21: imtcp: harden listener setup and legacy config cleanup 2026-05-21: imjournal: defensive memory safety and stability hardening 2026-05-21: docs: codify GHSA coordination workflow 2026-05-21: docs: clarify GHSA triage scope 2026-05-21: docs: add distro component package map 2026-05-21: docs: add GHSA coordination template 2026-05-21: contrib: harden buffer and parser bounds handling 2026-05-21: agent: document local CI preflight tiers 2026-05-21: Update tests/imptcpudsunlink.sh 2026-05-21: Apply suggested fix to tests/imptcpudsunlink.sh from Copilot Autofix 2026-05-20: ossl: bound OCSP network reads 2026-05-20: mmanon: defensively harden IP suffix parsing 2026-05-20: lookup: reject duplicate table names 2026-05-20: imptcp: harden concurrency, boundaries, and memory safety 2026-05-20: gtls: log peer IP for missing client cert 2026-05-20: config: add global maxOpenFiles setting 2026-05-20: build: fix ARMv7 warnings under Werror 2026-05-20: agents: add ChangeLog maintenance skill 2026-05-20: Update tests/imptcp-discard-truncated-msg-same-session.sh 2026-05-20: ChangeLog: update 8.2606 entries 2026-05-20: Apply suggested fix to tests/imptcp-discard-truncated-msg-same-session.sh from Copilot Autofix 2026-05-20: Apply suggested fix to doc/source/reference/templates/templates-reserved-names.rst from Copilot Autofix 2026-05-19: imptcp: discard oversize byte after truncation 2026-05-18: tcp: log pre-truncated oversize frames 2026-05-18: runtime: avoid libgcry IV shift UB 2026-05-18: grammar: read pseudo-files in backtick cat 2026-05-18: docker: add container regex noise filter 2026-05-18: doc: remove unavailable StdJSONFmt reference 2026-05-18: agents: require available container validation 2026-05-18: agents: clarify PR babysitting decisions 2026-05-18: ChangeLog: remove duplicate release blocks 2026-05-18: Apply suggested fix to doc/source/reference/templates/templates-reserved-names.rst from Copilot Autofix 2026-05-17: omelasticsearch: document error-file modes 2026-05-17: doc: list RFC5424 reserved template 2026-05-17: doc: clarify omfile timed flush behavior 2026-05-17: doc: clarify omfile legacy action separation 2026-05-17: containers: update libyaml dev image dependencies 2026-05-17: containers: remove stale dev images 2026-05-17: containers: enable libyaml in Fedora dev images 2026-05-17: containers: enable libyaml in CentOS and Debian CI 2026-05-17: build: honor cross pkg-config for libgcrypt 2026-05-16: devcontainer: remove anonymous helper volumes 2026-05-16: configure: make libyaml default-on explicit 2026-05-16: agents: clarify test intent comment rule 2026-05-15: ommail: add sendmail delivery mode 2026-05-15: omelasticsearch: warn on searchType use 2026-05-15: imdiag: add module-only modern config 2026-05-15: agents: clarify PR babysitting stop condition 2026-05-15: agents: add issue triage skill 2026-05-15: Potential fixes for 2 code quality findings (#6909) 2026-05-14: skills: clarify container validation escalation 2026-05-14: omfile: reject failed dynafile pre-opens 2026-05-14: netossl: fix clang-format style in CRL warning 2026-05-14: java: use nio writer in simple plugin skeleton 2026-05-14: imuxsock: reject contradictory socket ownership 2026-05-14: imfile: recover more inotify file updates 2026-05-14: Update .agent/skills/rsyslogtest/SKILL.md 2026-05-13: runtime: add STAILQ fallback for AIX 2026-05-13: netossl: fix CRL stack leak when cert store is NULL 2026-05-13: narrow CODEOWNERS ownership 2026-05-13: imdiag: add injectmsg delay option 2026-05-13: devcontainer: quote git common dir mount 2026-05-13: agents: document local overlay lookup 2026-05-13: queue: add per-queue size.enqueued counter (cumulative bytes) 2026-05-12: omrelp: allow TLS auth failure suspension 2026-05-12: imbeats: multiplex sessions for high client counts 2026-05-12: imbeats: harden batch parsing limits 2026-05-12: Apply suggested fix to tests/syslogcaller.c from Copilot Autofix 2026-05-12: Apply suggested fix to tests/imptcp-NUL.sh from Copilot Autofix 2026-05-11: runtime: harden atomic helper fallbacks 2026-05-11: packaging/rpm: add rsyslog-imbeats subpackage 2026-05-11: java: harden skeleton file handling 2026-05-11: imbeats: verify raw and amended ES pipeline 2026-05-11: imbeats: track cumulative Lumberjack sequences 2026-05-11: imbeats: tolerate interrupted poll calls 2026-05-11: imbeats: test Filebeat to Elasticsearch pipeline 2026-05-11: imbeats: harden compressed frame parsing 2026-05-11: imbeats: add Elastic Beats input module 2026-05-11: imbeats: add Elastic Agent Windows fixture test 2026-05-11: Apply suggested fix to tools/ompipe.c from Copilot Autofix 2026-05-11: Apply suggested fix to tests/syslogcaller.c from Copilot Autofix 2026-05-11: Apply suggested fix to runtime/atomic.h from Copilot Autofix 2026-05-11: Apply suggested fix to doc/ai/securitytriagerubric.md from Copilot Autofix 2026-05-10: imuxsock: harden trusted property annotation buffer 2026-05-10: immark: harden runtime config lifetime 2026-05-10: doc: add security triage rubric for AI agents 2026-05-10: [HARDENING] imjournal: harden disk usage stats update 2026-05-10: [HARDENING] imdiag: clarify controlled diagnostics usage 2026-05-09: hardning: harden config parameter ownership and OOM cleanup 2026-05-09: config: add compatibility controls and secure defaults 2026-05-08: rosi-collector: prevent Loki 400 queue stalls 2026-05-08: omdtls: check config string allocations 2026-05-08: mmrfc5424addhmac: harden SD-ID handling 2026-05-08: mmleefparse: check config string allocations 2026-05-08: imbeats: join session threads during teardown 2026-05-08: Fix chkseq EOF handling 2026-05-07: python: make file cleanup lexical 2026-05-07: python: fix external plugin comment typos 2026-05-07: python: close script file handles 2026-05-07: imudp: add dynamic listen port files 2026-05-07: impstats: remove obsolete svg jquery asset 2026-05-07: doc: harden docs config AI fixes 2026-05-07: devcontainer: allow sudo for mapped users 2026-05-07: Update doc/source/confhelpers.py 2026-05-07: Fix operator precedence in conditions 2026-05-07: Apply suggested fix to tests/omfwd-lb-1target-retry-testskeleton-TargetFail.sh from Copilot Autofix 2026-05-07: Apply suggested fix to tests/chkseq.c from Copilot Autofix 2026-05-07: Apply suggested fix to doc/source/confhelpers.py from Copilot Autofix 2026-05-06: scripts: restore repo policy helpers 2026-05-06: scripts: align module policy evaluator name 2026-05-06: netossl: support CRL/OCSP revocation on wolfSSL 2026-05-06: java: simplify simple plugin file creation 2026-05-06: impstats: clean up svg jquery findings 2026-05-06: impstats: avoid analyzer wildcard import 2026-05-06: doc: import optional extensions during probe 2026-05-06: doc: broaden optional extension probe errors 2026-05-06: doc: avoid unused python imports 2026-05-06: Apply suggested fix to packaging/docker/rsyslog/standard/Dockerfile from Copilot Autofix 2026-05-05: ratelimit: preserve severity sentinel on s390x 2026-05-05: imtcp: wait for mbedtls diagnostics in tests 2026-05-05: imtcp test: capture mbedtls diagnostics directly 2026-05-05: Add Ubuntu WSL development setup 2026-05-04: improg: stop on child stdout EOF 2026-05-04: github action: remove issue labler 2026-05-04: codeql: silence unused global findings 2026-05-04: codeql: add explicit Python fallbacks 2026-05-04: Apply suggested fix to runtime/datetime.c from Copilot Autofix 2026-04-30: ossl: match PermittedPeer wildcards against cert identities 2026-04-30: Fix omrelp TLS auth failure CPU spin 2026-04-29: packaging/rpm: Add omotel OpenTelemetry Sub-package 2026-04-28: packaging: add multi-arch container release publishing 2026-04-28: Fix RFC3339 formatting for high-precision secfrac 2026-04-25: queue: quarantine runtime disk corruption safely 2026-04-25: imfile test: stabilize async logrotate drain 2026-04-25: Add security policy 2026-04-24: imhttp: harden request parsing and cleanup (#6758) 2026-04-24: imdocker: stabilize image-name test 2026-04-23: omuxsock: fix message loss bug for connected Unix domain sockets (#6750) 2026-04-23: imfile: release deleted-file FDs after FILEDELETEDELAY in inotify mode 2026-04-23: .codex: restore wrapped git commit hook matching 2026-04-22: omusrmsg: guard empty systemd session lists 2026-04-22: omfwd: avoid recursive target teardown 2026-04-22: fmhash: fix build issue 2026-04-22: doc: update modules documentation (#6714) 2026-04-21: prepare for next scheduled stable release cycle 2026-04-20: style: format obj helper declaration 2026-04-20: style: drop redundant cstr null checks 2026-04-20: queue: harden corrupt disk queue recovery 2026-04-20: queue: delete orphaned disk queue write files 2026-04-20: prepare for 8.2604.0 release 2026-04-20: omfwd: flush pending data before zip teardown 2026-04-20: imptcp: harden stream compression handling 2026-04-20: doc: shrink ROSI architecture image in dist 2026-04-19: imfile: harden state file handling 2026-04-19: core: harden string allocation and copy handling 2026-04-18: omotel: ignore generated protobuf tree 2026-04-18: imkafka: harden worker startup and teardown 2026-04-18: imhiredis: place stream index helper before use 2026-04-18: imhiredis: harden stream index parsing and setup 2026-04-18: imdocker: harden setup and URL construction 2026-04-18: imdocker,imhiredis: fix curl teardown and style 2026-04-17: imudp,imdtls: harden listener setup paths 2026-04-17: imdtls: disable failed listeners cleanly 2026-04-17: gssapi: fix token timeout handling 2026-04-17: gssapi: fix interrupted token io loops 2026-04-17: doc: clarify severity-aware shared ratelimit use 2026-04-16: imjournal: harden state file handling 2026-04-16: im3195: harden RFC3195 callback handling 2026-04-16: gssapi: improve robustness and listener handling 2026-04-15: runtime: harden queue config and worker handling 2026-04-15: omfile: harden dynafile cache validation 2026-04-15: omfile: address review follow-up cleanups 2026-04-14: omrelp: use stable data in librelp callbacks 2026-04-14: omrelp: use generic code in onErr 2026-04-14: omfwd: support musl resolver APIs 2026-04-14: omelasticsearch: fix port detection for IPv6 server addresses 2026-04-14: imhttp: add route-scoped API key authentication 2026-04-14: configure: reduce resolver link probe 2026-04-14: configure: link resolver libs on solaris 2026-04-14: configure: gate omfwd resolver APIs 2026-04-13: runtime: add watched policy reload scheduling 2026-04-13: ratelimit: free dropped TCP messages on helper errors 2026-04-13: [Modernization] Replace Internal Backticks with Shell Expansion: Misc test files 2026-04-13: Add missing mmdb files to tests/Makefile.am 2026-04-12: runtime: cleanup zero-size alloc handling 2026-04-12: rsconf: clarify stale loadConf comments 2026-04-12: ratelimit: keep TCP batch processing on drops 2026-04-12: omhttp: harden payload length handling 2026-04-12: imuxsock: bound per-pid ratelimiter cache 2026-04-12: imtcp: harden limit validation and worker shutdown 2026-04-12: impstats: clean up minor report nits 2026-04-12: fix(imtcp): fix typos and remove duplicate assignments in imtcp.c 2026-04-12: Fix for Unused import 2026-04-12: Fix for File is not always closed 2026-04-11: add compression option with new test and changed request building 2026-04-09: runtime: harden stringbuf contains matching 2026-04-09: runtime: harden TCP framing size handling 2026-04-08: mmutf8fix: also fix invalid UTF-8 in RFC 5424 structured data 2026-04-07: ratelimit: watch YAML policy files with debounce 2026-04-06: [Modernization] Replace Internal Backticks with Shell Expansion 2026-04-06: Discard partial map/array objects on error 2026-04-04: doc: document omfwd connection statistics 2026-04-03: runtime: map common legacy selector actions to YAML 2026-04-03: runtime: harden YAML string-node OOM handling 2026-04-03: runtime: emit structured YAML for simple translations 2026-04-03: grammar: fix YAML script buffer filename leak 2026-04-02: runtime: add config translation mode 2026-03-31: omelasticsearch: suspend action on 5xx or 429 HTTP status codes 2026-03-31: omelasticsearch: check HTTP status code in checkConn health check 2026-03-31: [build]: require OpenSSL if imdtls or omdtls is used 2026-03-30: mmjsontransform: reload transformation mode from policy 2026-03-30: mmjsontransform: add YAML policy processing 2026-03-30: build: stop shipping .gitignore files 2026-03-30: [codex] doc: fix random sampling example (#6678) 2026-03-30: [General]: Install tzdata in default docker image 2026-03-30: Fix DoS in imjournal sdjournalwait 2026-03-29: doc: remove stray merge marker in deployments index 2026-03-29: doc: clarify YAML positioning and workflow guidance 2026-03-28: yamlconf: warn on duplicate top-level keys, document as unsupported 2026-03-28: scripts: add doc-xref-sync linter check for broken :doc: references 2026-03-28: doc: register designdecisions.rst in EXTRADIST 2026-03-28: doc(yamlconf): fix EXTRADIST entry and cross-reference path 2026-03-28: doc(yamlconf): add architecture doc, expand RainerScript relation 2026-03-28: doc(yamlconfig): add version requirement note (8.2604.0+) 2026-03-28: doc(confformats): use FmtYamlName macro, fix macro-in-bold issue 2026-03-28: doc(confformats): add YAML as fourth format option, cross-link pages 2026-03-27: test(yaml-unset): guard against false pass when verify file is absent 2026-03-27: refactor(yamlconf): extract nvlst helper, add Doxygen, fix test coverage 2026-03-27: feat: add YAML as an alternative configuration format 2026-03-27: docs(agents): add rsyslogconfig skill and config parity guidance 2026-03-27: doc(yamlconf): improve completeness of YAML config reference 2026-03-27: doc(yamlconf): fix malformed RST grid table (Set row off by one space) 2026-03-27: devtools: add repo-local Codex commit hook 2026-03-26: feat: add YAML as an alternative configuration format 2026-03-26: feat(yamlconf): add filter/actions shortcut for rulesets 2026-03-25: omhttp: reuse curl handles and coordinate health checks 2026-03-25: omhttp: fix shared health state and gzip headers 2026-03-24: gtls: check CRL expiration, reject connections with expired CRL 2026-03-23: doc: imptcp: remove outdated 16-thread limit note 2026-03-21: doc/container: mark ETL image experimental 2026-03-20: update doc url in README.md 2026-03-20: doc: sync container docs with current images 2026-03-20: doc: fix ROSI link audience in overview pages 2026-03-19: doc: link ROSI references to overview page 2026-03-19: doc: improve ROSI navigation and scope notes 2026-03-19: doc: broaden ROSI framing beyond collector 2026-03-18: doc: document Windows clients in ROSI Collector 2026-03-18: doc: add ROSI stack deployment tutorial 2026-03-16: omfwd: add num.connects statistic for TCP connection tracking 2026-03-16: imfile: preserve symlink cleanup notifications with deferred destroy 2026-03-16: core: Fix typos in comments 2026-03-13: doc: Fix Mermaid diagrams and unify build output to build/ 2026-03-11: tls: add native post-quantum guidance and tests 2026-03-11: packaging: add Ubuntu package build CI for focal, jammy, noble 2026-03-10: docs: clarify PrioritizeSAN fallback behavior and auth mode prerequisite 2026-03-10: Add azure Monitor API ingestion module 2026-03-04: Use suggested error handling when node becomes NULL mid-loop 2026-03-04: Remove "ifdef jsontypeuint64" 2026-03-04: Discard partial map/array objects on error 2026-03-04: Add uint64 handling if it is supported 2026-03-03: rpm: packaging overhaul, CI job, and review fixes 2026-03-02: imjournal documentation: FileCreateMode was introduced in v8.2306.0 2026-03-02: docs: remove -c5 from troubleshooting example 2026-02-27: Revert "docs: Add ROSI Collector Hetzner Cloud tutorial" 2026-02-26: ratelimit: wire ratelimit.name into remaining modules 2026-02-26: omusrmsg: add ratelimit support 2026-02-26: omkafka: add poll thread; fix races and deprecated usleep 2026-02-26: imrelp: add ratelimit support (interval, burst, name) 2026-02-26: Stop all outer recursive loops in MAP case on corrupted data 2026-02-26: Skip truncated field 2026-02-26: Replace Variable-Length Array with fixed sized one 2026-02-26: Address style/formatting issues 2026-02-26: Add json NULL checks 2026-02-25: packaging: Update RHEL Docker Build Image 2026-02-25: omotel: add native protobuf encoding (http/protobuf) 2026-02-25: docs: Add ROSI Collector Hetzner Cloud tutorial 2026-02-25: doc: add deterministic HTML link validation in docs CI 2026-02-25: Update mmdblookup so it does not rely on JSON dump 2026-02-24: doc: fix stale relative links causing malformed paths 2026-02-24: doc: bump footer copyright year to 2026 2026-02-24: doc: add ROSI guides and beginner infographic 2026-02-24: Codex/process GitHub issue 4697 (#6582) 2026-02-23: runtime: close worker-start cancellation race 2026-02-22: doc: update canonical location for doc set 2026-02-18: tools: fix linking issue with libyaml 2026-02-18: runtime: refactor dynstats meta-counter name assembly 2026-02-18: prepare for next scheduled stable release cycle 2026-02-18: doc: fix releasestringdetail NameError, narrow deploy to main only 2026-02-18: doc: add GitHub Actions workflow to deploy docs with GA to Pages 2026-02-18: doc: add GA support with input validation and fallback (#6561) 2026-02-18: core: expand checked literal copies across fixed buffers 2026-02-17: doc: add optional Google Analytics via sphinxcontrib-googleanalytics (#6559) 2026-02-17: ChangeLog: correct overhyped feature 2026-02-17: ChangeLog: add missing entry 2026-06-23: bump version number for scheduled stable release 2026-02-16: configure: default-enable impstats push build support (#6542) 2026-02-16: better handle copy of constant string to ip address buffer (#6557) 2026-02-13: imjournal: fix stats counter type for uint64 fields 2026-02-13: doc: restructure impstats reference for clearer modes 2026-02-13: doc: expand impstats push docs and FAQ coverage 2026-02-13: doc: describe impstats push mode for VictoriaMetrics 2026-02-13: doc: add impstats VictoriaMetrics push tutorial 2026-02-11: runtime: iterate ptcp addresses and validate bind device 2026-02-11: feat(rosi-collector): impstats sidecar on server, Grafana rate limits, docs 2026-02-08: packaging/docker: trim ubuntu24 image build artifacts 2026-02-08: omhttp: add VictoriaLogs jsonline CI test 2026-02-08: curl modules: pass long literal to CURLOPTPOST 2026-02-06: omhttp: reuse reply buffer with cap and safer sizing 2026-02-06: github action security follow up (#6532) 2026-02-06: build: normalize object prototypes and remove decl noise 2026-02-04: Sentinel: Fix buffer overflow risk in datetime formatting 2026-02-04: doc: fix conflict markers in omhdfs-omhdfsport.rst 2026-02-04: Fix infinite loop in reextract when regex matches empty string 2026-02-04: Codex/fix issue #6517 in rsyslog (#6520) 2026-02-03: runtime: lower internal message rate defaults 2026-02-03: rosi-collector: add Syslog Health (impstats) dashboard and client sidecar 2026-02-03: doc: improve sparseArray doc and suggest isinsubnet 2026-02-03: doc/ommail: correct CRLF escaping; bind body template 2026-02-03: Fix lookup table reload race condition (Device or resource busy) 2026-02-03: Fix build failure with OpenSSL 3.4.3+ due to deprecated ENGINE API 2026-02-03: Codex/add documentation for pcre matching (#6509) 2026-02-02: runtime: include IPv6 scope id in DNS cache keys 2026-02-01: ossl: make OCSP requests non-blocking with caching 2026-01-31: runtime: fix srUtilItoA() data type inconsistencies 2026-01-31: impstats: add VictoriaMetrics push via Remote Write 2026-01-30: stream: lock open/init and defer error log 2026-01-30: runtime: call class exit on lib unload 2026-01-30: nsdossl: abort failed handshakes 2026-01-29: runtime: clarify atomic helper usage 2026-01-29: queue: fix slow drain of disk-assisted queues 2026-01-29: queue: fix DA worker infinite loop regression from commit 4748c5746 2026-01-29: imkafka: add JSON batch splitting for Azure Event Hub 2026-01-29: fix(obj): use best-effort atomics for ifIsLoaded to eliminate TSAN warnings 2026-01-28: omfile: pass size-limit file to rotate cmd 2026-01-28: configure: fix xxhash library check missing error action 2026-01-25: imtcp: add MultiLine and regex framing support 2026-01-25: SQUASH: some fixes 2026-01-24: template: add omitIfZero option to property() 2026-01-24: agent/skills: standardize test registration and mock check 2026-01-23: tools: honor mainqueue name override 2026-01-23: skills: implement extended documentation distribution check 2026-01-23: fix(tools): graceful exit on recvfrom error in waittimeout 2026-01-23: doc: refine memory auditor guidelines with CHKmalloc and NULL checks 2026-01-23: core: streamline agent instructions with modular skills 2026-01-23: action: add batchesprocessed pstats counter 2026-01-22: imfile: add inode generation check for file rotation detection 2026-01-21: sidecar: add rsyslog impstats exporter 2026-01-19: ossl: add OCSP certificate revocation checking support 2026-01-17: nitfix: add output files to .gitignore 2026-01-17: imfile: add inotify fallback rescans on watch limits 2026-01-17: doc: add imfile new parameter doc 2026-01-16: queue: harden disk recovery after invalid .qi 2026-01-16: core: fsync+atomic rename for pid file; abort on failure 2026-01-16: build: move doc EXTRADIST into doc/Makefile.am 2026-01-15: mmanon: add retry limit + fallback for unique randomization (#6444) 2026-01-14: Improve test infrastructure: fix core dump race condition 2026-01-13: fix pmlastmsg.c typo error 2026-01-13: docs: Add Core Philosophy page 2026-01-13: doc: deprecate omruleset; add call migration guide 2026-01-12: rainerscript: add isinsubnet() built-in 2026-01-12: omhiredis: remove unneded param name from param table 2026-01-12: omfile: fix pszSizeLimitCmd leak; own copy from outchannel 2026-01-12: nitfix: code style 2026-01-12: imfile: guard statefile unlink and honor RMStateOnMove 2026-01-12: doc: imhttp: document ability to bind to specific IP addresses 2026-01-12: doc: add FAQ about blocking actions and queues 2026-01-12: core: make action state changes output better debug info 2026-01-09: action: guard worker instance check on non-atomic builds 2026-01-09: Fix: Use hasinclude to check for rabbitmq-c headers 2026-01-09: Fix imjournal test race condition with parallel execution 2026-01-08: contrib/imczmq,omczmq: add CZMQ 4.2+ version guards 2026-01-07: runtime: fix race condition in worker thread cancellation 2026-01-07: runtime: fix inconsistent synchronization of iCurNumWrkThrd 2026-01-07: runtime: fix TOCTOU race in worker thread creation 2026-01-07: omsnmp: fix legacy config path and session strings 2026-01-06: runtime: fix race condition in worker thread startup 2026-01-06: runtime: fix critical data race in wtpSetState() 2026-01-06: lmsigksi: remove unused REPORTPARAMMISSING macro 2026-01-06: Fix mmsnareparse test data files missing in make dist 2026-01-05: tcpflood: nitfix w/ compiler warning when DTLS is not configured 2026-01-05: rainerscript: add split() function 2026-01-05: doc: optimize agent build instructions for efficiency 2026-01-05: doc: add sparseArray lookup IPv4 subnet matching example 2026-01-05: core/AIX: fix an hard exit() on certain failure at AIX 2026-01-05: Refactor duplicate string copy logic in msg.c 2026-01-05: Refactor Prometheus stats generation to a separate function 2026-01-04: queue: re-implement queue size warnings 2026-01-04: doc: imrelp: clarify missing MaxSessions and session stats (#6414) 2026-01-03: runtime/ratelimit: annotate ratelimit nonnull contracts 2026-01-02: tcpsrv: restore default stack size assignment 2026-01-02: runtime/nsdossl.c: fix authmode authorization bypass 2026-01-02: integer parsing more robust 2026-01-01: core, runtime, omfwd: plumb action name into modules and logs 2025-12-31: core: improve some important inline documentation 2025-12-30: omelasticsearch fix: potential NULL dereference 2025-12-30: msg, docs: document jsonMerge overwrite; drop TODO 2025-12-30: imjournal: make PRIORITY parsing robust and quiet 2025-12-29: ratelimit: add named policies; wire into imtcp/imptcp 2025-12-29: docs: add module template and tighten RST AI authoring rules 2025-12-29: build: add missing doc files to EXTRADIST 2025-12-28: ossl: fix ctx double-free and config string leaks 2025-12-28: omkafka fix: double-free of kafkaheader if used 2025-12-28: imjournal: remove unused ctrPollFailed 2025-12-27: Add rsyslog-doc AI assistant prompt and update meta-docs 2025-12-26: Update tests/omfwdrebindudp.sh 2025-12-25: runtime/rsksi: check KSIDataHashextract return values 2025-12-25: Architectural Analysis of Rsyslog Core (#6390) 2025-12-24: rainerscript: ensure parsejson consumes entire input string 2025-12-24: rainerscript: add split() function 2025-12-24: omfwd: fix RebindInterval suspension and improve UDP cleanup 2025-12-24: docs: refactor AGENTS.md for agent clarity, safety, and precision 2025-12-23: rainerscript: ensure parsejson consumes entire input string 2025-12-23: fix improper ":json:" use 2025-12-23: doc: fix version (accidentally not updated) 2025-12-23: Update doc/source/reference/parameters/omudpspoof-template.rst 2025-12-22: nitfix: code style violations 2025-12-22: netstream ossl driver: small fix in meta information 2025-12-22: doc: add RAG Knowledge Base extraction and build integration 2025-12-21: docs: formalize defensive coding and assertion patterns 2025-12-21: doc: modernize and expand queue concept documentation 2025-12-21: doc: fix missing EXTRADIST entry 2025-12-19: rsyslog-ossl: Prevent double close of socket fd 2025-12-19: impstats: add log.file.overwrite parameter for atomic overwrites 2025-12-19: doc: update agent guidelines to require documentation for new parameters 2025-12-17: omudpspoof: update RainerScript examples 2025-12-17: imjournal: fix potential segfault (SIGBUS) 2025-12-17: doc: fix RST syntax errors in parameter documentation 2025-12-17: Remove macos-13 from CI and weekly jobs 2025-12-17: Fix doc build CI security, spelling, and RST build errors 2025-12-16: omudpspoof: fix module template example 2025-12-16: Refactor: rename omotlp module to omotel 2025-12-15: doc: unify mmanon random-consistent-unique text 2025-12-15: Add support healthchecktimedelay into omhttp 2025-12-11: omudpspoof: split parameter docs into reference pages 2025-12-11: omudpspoof: correct parameter scopes in references 2025-12-11: omudpspoof: align parameter casing with camelCase guidance 2025-12-11: omsnmp: align parameter heading with module scope (#6354) 2025-12-11: Codex/refactor rsyslog parameter documentation n6uh16 (#6345) 2025-12-11: Codex/refactor module parameter documentation atexhg (#6355) 2025-12-11: Codex/refactor module parameter documentation (#6349) 2025-12-11: Codex/refactor module documentation into parameter files (#6348) 2025-12-05: prepare for next daily stable cycle 2025-12-05: omdtls: fix incorrect usage of gaistrerror 2025-12-05: mmjsontransform: fix compiler warning 2025-12-05: core: fix LogError(0, ...) anti-pattern and add guidelines 2025-12-05: build: fix missing test files in dist tarball 2025-12-04: omhiredis: Allow to define a name to instance and use it in logs 2025-12-04: doc: fix some small glitches 2025-12-03: packaging/docker: add TLS support to collector image 2025-12-03: mmanon: better document externalized function part 2025-12-03: docs: clarify coding practices path in prompts 2025-12-03: docs: add assert-plus-fallback helper guidance 2025-12-03: docker/collector: always load imtcp module 2025-12-03: doc: handle backslash continuations in rsyslog lexer 2025-12-03: doc: add contract pattern for externalized helpers 2025-12-02: mmanon: fix spacing for format 2025-12-02: doc: fix omlibdbi parameter examples 2025-12-02: New functionality for omuxsock (#5630) 2025-12-01: omuxsock documentation changes 2025-12-01: mmanon: tidy inline comments 2025-12-01: imtcp: add NetworkNamespace 2025-12-01: Codex/refactor rsyslog parameter documentation 8z2p3x (#6327) 2025-11-30: omfwd: add DNS SRV discovery (targetSrv) 2025-11-28: feat(deploy): add ROSI Collector centralized log collection stack 2025-11-28: Codex/refactor rsyslog parameter documentation (omjournal) (#6309) 2025-11-26: doc: add TLS example for omelasticsearch 2025-11-25: mmsnareparse: make regex trailing search limit configurable 2025-11-25: mmanon: fix races in IPv4 trie and IPv6 hash access (#6315) 2025-11-25: doc: add SETUP, BUILD, TEST agent task keywords 2025-11-25: Codex/refactor rsyslog module parameter documentation wnkysy (#6311) 2025-11-24: mmsnareparse: add parameter ignoreTrailingPattern.regex 2025-11-21: mmsnareparse: add ignoreTrailingPattern parameter 2025-11-21: build: Add code coverage targets 2025-11-18: doc: some nitfixes to historical doc 2025-11-18: doc: add conceptual model summaries 2025-11-18: Codex/refactor omdtls documentation for parameters (#6298) 2025-11-17: mmsnareparse: add Sysmon event support via JSON definition file 2025-11-17: doc: add json-ld (basic schema) (#6303) 2025-11-14: doc: restructure and modernize project history; add origins page and xrefs 2025-11-14: container: add libyaml to some dev containers 2025-11-14: Fix: Remove stray/unwanted 'rsyslog' subproject 2025-11-14: Codex/refactor rsyslog module documentation parameters (#6296) 2025-11-12: omhttp - Add two profile for Splunk HEC (#6150) 2025-11-12: fix codestyle issue (minor) 2025-11-12: Codex/refactor rsyslog parameter documentation fvn43p (#6290) 2025-11-12: Codex/refactor rsyslog module parameter documentation omgssapi (#6294) 2025-11-09: doc: add FAQ if rsyslog runs on windows 2025-11-07: Implement Kafka Metrics, new pstats format (#6154) 2025-11-06: fix typo in European mirror link (https vs. http) 2025-11-06: doc: clarify release channels in versioning guide (#6289) 2025-11-05: doc: add release version number semantic info (#6286) 2025-11-05: Codex/refactor rsyslog module parameter documentation s7jgy3 (#6277) 2025-11-05: Codex/refactor rsyslog module parameter documentation p47sz4 (#6285) 2025-11-05: Codex/refactor rsyslog module parameter documentation khpye2 (#6276) 2025-11-05: Codex/refactor rsyslog module parameter documentation bn356b (#6287) 2025-11-05: Codex/refactor rsyslog module documentation b6q3fv (#6281) 2025-11-04: feat(imhiredis): Add support for TLS in imhiredis (#21) 2025-11-03: nsdgtls: fix repeated warnings on connection retry + test 2025-11-03: contentcountcheck: use optional file argument if provided 2025-11-03: README.md Updates for clarity and content (#6282) 2025-11-03: Enhance README with Table of Contents and new sections (#6283) 2025-10-31: tcpsrv: stop workers before destruction 2025-10-31: PoC: rsyslog ETL pipeline container for sending to vespa.ai 2025-10-30: omhttp - Stats by destination server (#6141) 2025-10-30: Fix typos: corrected 'intial' to 'initial' and 'intialize' to 'initialize' 2025-10-30: Codex/refactor rsyslog module parameter documentation rgp0jv (#6256) 2025-10-30: Codex/refactor module name parameters documentation (#6250) 2025-10-30: Add support for TLS in omhiredis (#17) 2025-10-29: omelasticsearch: add apikey authentication 2025-10-29: doc: fix trailing whitespace in man pages 2025-10-29: doc: add faq entry for rsyslog as etl tool (#6272) 2025-10-29: doc: add FAQ for sending data to vespa.ai 2025-10-24: doc/build: ship vendor/tools; make sitemap opt-in 2025-10-24: action.c: reordered actionDestruc 2025-10-23: doc: enable sphinx sitemap generation for html output 2025-10-22: doc: vendor mermaid assets and fix offline viewing 2025-10-22: doc: update SIGINT signal documentation in man page 2025-10-20: doc: make git optional for Sphinx builds (dist tarballs) 2025-10-20: doc: enable parallel Sphinx builds; silence editongithub 2025-10-17: Add doc for mbedtls driver 2025-10-15: bump version number for 8.2512 series 2025-10-15: Doc: Minor spelling and typing mistakes (#6242) 2025-10-15: Codex/refactor rsyslog imklog module parameter documentation (#6246) 2025-10-13: Codex/refactor parameter documentation for imkafka (#6243) 2025-10-11: core: stop busy-loop when action disables itself 2025-10-11: Add MbedTLS netstream driver. 2025-10-10: Codex/refactor rsyslog imgssapi module parameter documentation (#6239) 2025-10-10: Codex/refactor rsyslog imdiag module parameter documentation (#6235) 2025-10-09: prepare for 8.2510.0 scheduled stable release 2025-10-09: ossl bugfix: ensure peer cert is freed in osslChkPeerAuth 2025-10-09: omotlp: introduce OTLP/HTTP log exporter 2025-10-07: mysql: stabilize async ommysql workers via proper thread init 2025-10-07: imptcp: fix null pointer dereference in error logging 2025-10-07: docs: add Agent Chat Keywords to AGENTS.md 2025-10-06: feat: Trigger macOS workflow on relevant file changes 2025-10-06: doc: im prove log pipeline documentation 2025-10-06: doc: clarify reliable forwarding examples 2025-10-06: Fix: Make RSYSLOGDYNNAME generation POSIX-compliant 2025-10-05: doc: refresh database and PRI tutorials 2025-10-05: doc: improve mmjsonparse documentation 2025-10-05: Codex/refactor rsyslog parameter documentation 68okf4 (#6219) 2025-10-04: mmjsonparse: add find-json mode for embedded JSON 2025-10-04: Codex/refactor rsyslog module documentation (#6215) 2025-10-04: CI,DIST: build docs from 'make dist' tarball 2025-10-02: test: Enable Valgrind for manytcp-too-few-tls-vg.sh 2025-10-02: Increase message loss tolerance in TargetFail test 2025-10-01: template: fix lenStr for subtree rendering 2025-10-01: mmjsontransform: add experimental JSON dotted-key (un)flatten 2025-09-29: omkafka: restore producev fallback for older librdkafka 2025-09-29: omelasticsearch: implement target platform check (#6197) 2025-09-29: mmexternal: split parameter in doc (#6193) 2025-09-29: imtcp: Improve peer logging to include source ports (#6198) 2025-09-29: CI containers: include mbedtls test environment 2025-09-28: imdiag/tests/docs: use RFC5737 test IP in samples 2025-09-28: Codex/refactor parameter documentation for mmjsonparse (#6189) 2025-09-27: doc: split property documentation into separate files 2025-09-26: docs: add agent guides and module metadata scaffolding 2025-09-26: mmanon: split parameter docs into reference 2025-09-25: omelasticsearch: omit type by default; use typeless endpoint 2025-09-25: doc: update imjournal journald warning 2025-09-24: template: add jsonftree option for nested jsonf output 2025-09-24: mmfields: split parameter docs into reference pages 2025-09-23: omusrmsg bugfix: potential null pointer dereference causes segfault 2025-09-23: omfile: enable addLF by default 2025-09-23: mmsnarewinsec: comprehensive Windows Security Event Log parser 2025-09-23: doc: improve subtree, list template documentation 2025-09-23: doc: further improve template doc 2025-09-23: Update doc/source/reference/templates/templates-type-list.rst 2025-09-23: Codex/refactor module documentation for mmdblookup 2025-09-22: omfile: add addLF option to append newline (#6165) 2025-09-22: Codex/refactor rsyslog parameter documentation inmmexternal 2025-09-22: Codex/document mmaudit plugin with sphinx (#6167) 2025-09-20: tests/omelasticsearch: align suite with ES 7.14, reduce flakiness 2025-09-19: refactor rsyslog parameter documentation mmdarwin 2025-09-19: refactor rsyslog parameter documentation mmcount 2025-09-19: refactor rsyslog module parameter documentation mmaitag 2025-09-18: omazureeventhubs: fix data races and suppressions 2025-09-18: mmleefparse: new message modification module for LEEF format 2025-09-17: doc: Add helper scripts to build documentation 2025-09-17: imtcp: warn on TLS handshakes received on plain listeners 2025-09-16: refactor rsyslog parameter documentation mmutf8fix 2025-09-15: fix config error on systems with pkg-config but not libgcrypt-config 2025-09-15: docs/gettingstarted: add AI assistants page 2025-09-15: doc: new beginner tutorials 2025-09-15: dev container: do not work-around libgcrypt dev interface change 2025-09-13: doc: describe regex lookup table type 2025-09-13: Codex/refactor rsyslog parameter documentation for mmtaghostname 2025-09-12: logctl tool: fix mongoc.h include location 2025-09-12: docs: fix doc build instructions (Sphinx 4.5+, main, monorepo) (#6114) 2025-09-12: docker: fix collector, udp and tcp could not be enabled individually 2025-09-12: docker: enhancements to debian sid and ubuntu 24.04 dev container 2025-09-12: docker: add relp listener to rsyslog "collector" 2025-09-12: doc: document compactjsonstring global option (#6127) 2025-09-12: doc: better doc for rsyslog collector container 2025-09-12: core: add doxygen comments to errmsg object 2025-09-11: refactor rsyslog module parameter documentation for mmsnmptrapd 2025-09-11: net: Add NetworkNamespace APIs 2025-09-11: imtcp support for NetworkNamespace 2026-02-16: prepare for 8.2602.0 scheduled stable release 2025-09-10: tls: process TLS 1.3 KeyUpdate during send (ossl/gtls) 2025-09-10: improve original patch 2025-09-10: docker: update Debian 13 build to inlcude more modules 2025-09-10: doc: improg had a strangely worded limitation listed - corrected (#6115) 2025-09-10: Update doc/README.md 2025-09-09: doc: update reference section on doc structure 2025-09-09: core: add setting to permit compact json format 2025-09-09: Codex/refactor rsyslog module parameter documentation mmrfc5424addhmac 2025-09-09: CI remove old kafka codecov builder now the new one is present 2025-09-06: doc: document git path resolution 2025-09-06: devtools: Specify usage of clang-format-18 to pin v18 2025-09-05: rainerscript: add toupper() function 2025-09-05: misc: add void parameter lists 2025-09-05: doc: restore missing doc files in configure.ac 2025-09-04: imhttp: guard handler registration 2025-09-04: devtools: use codecov uploader in CI script 2025-09-04: config script: add b64decode function 2025-09-04: Update devtools/run-ci.sh 2025-09-04: Codex/refactor rsyslog parameter documentation ejsnoq (#6085) 2025-09-03: runtime: fix Darwin build regressions and improve BSD portability 2025-09-03: omkafka: allow sending static headers 2025-09-03: mmpstrucdata: split parameter docs into reference pages 2025-09-03: mmpstrucdata: fix action parameter anchors and casing 2025-09-03: imdocker: Add image name to metadata fields 2025-09-03: code style: fix macro formatting 2025-09-03: ci(docs): add PR preview workflow via Actions Pages 2025-09-03: Implement omhttp batching and performance improvements 2025-09-03: Codex/refactor rsyslog parameter documentation (#6074) 2025-09-02: omsnmp: restructure (#6063) 2025-09-02: imrelp: fix potential segfault on termination (#5600) 2025-09-02: core: add fromhost-port message property 2025-08-28: tools/rsyslog.conf.5: fix example Port= value 2025-08-28: rainerscript: warn on excessive random range 2025-08-28: queue: refactor batch deletion with explicit phases (#6013) 2025-08-28: omsendertrack: "fix" static analyzer reported issue 2025-08-28: doc: work around a spellcheck restriction 2025-08-28: doc: note AI authorship\n\nAI-Agent: ChatGPT 2025-08-28: core: some code cleanup 2025-08-28: community: disable automatic welcome action 2025-08-28: code cleanup (rephrasing false postive commented out code) 2025-08-27: improve PR welcome message handling 2025-08-27: docs: fix typo ('begin' -> 'beginning') in developer documentation (#6029) 2025-08-27: docs: fix minor typos in docs/source (#6028) 2025-08-27: doc: fix assorted typos across documentation 2025-08-27: debug version of welcome script 2025-08-27: community: some fixes to "welcome" helper action 2025-08-27: community: add welcome message to first few commits (#6032) 2025-08-27: codeql: fix "master" branch reference 2025-08-27: Potential fix for code scanning alert no. 44: Commented-out code 2025-08-27: Add actions analysis 2025-08-26: prepare for next scheduled stable release cycle 2025-08-26: docs: add rsyslog issue assistant build files (#6026) 2025-08-26: dev doc: mention "good first issue" dashboard 2025-08-26: Update README.md 2025-08-25: prepare for daily stable 8.2508.0 release 2025-08-25: fix: doc/ not in tarball (in progress) 2025-08-25: doc: add code of conduct 2025-08-24: omrelp: add TCP keepalive configuration 2025-08-23: immark: document config cleanup 2025-08-23: imdocker: free temp buffer after log option parse 2025-08-22: tcpsrv: revert PR 5806 because it was ineffective 2025-08-22: tcpsrv: refactor IO loop; rearm-before-unlock; poll path 2025-08-22: imjournal: initialize instance fields to avoid invalid free 2025-08-22: imdocker: fix cosmetic memory leak 2025-08-21: runtime/tcpsrv: drop obsolete inQueue handling 2025-08-21: omhttp: guard rest path template access 2025-08-21: mmaitag: fix potential memory leak 2025-08-21: doc: restructure templates docs into hub and refs 2025-08-21: doc: restore property statement context 2025-08-21: core: code cleanup, avoid dead assignment 2025-08-21: core/nsdptcp: zero addr before getpeername() 2025-08-20: tcpsrv: stop loop after closeSess to avoid use-after-free 2025-08-20: omprog: split parameter docs into reference pages 2025-08-20: omfwd: document and enforce pool-level suspend semantics 2025-08-20: Update README.md - notification channels 2025-08-20: Update .github/instructions/modules.plugins.instructions.md 2025-08-19: imhttp: optional auth + Content-Length for metrics/health 2025-08-19: doc: make AI-First concrete; add guardrails and CI proof 2025-08-19: atomic: remove trailing semicolons from helper macros 2025-08-18: template: fix missing lenStr in subtree templates 2025-08-18: tcpflood: omit delimiter for octet frames 2025-08-18: serialize TLS session setup to avoid data race 2025-08-18: runtime: fix NetstreamDriverCAExtraFiles parsing 2025-08-18: omsendertrack: stop towards full completion of module. 2025-08-18: omhttp: add profile support and revise HTTP retry semantics 2025-08-18: imuxsock: tidy parameter docs and links 2025-08-18: imuxsock: split input parameter docs into reference pages 2025-08-18: imptcp: split parameter docs into reference pages 2025-08-18: docs: streamline contrib templates and commit guidance 2025-08-18: docs: split imfile module parameters (#5941) 2025-08-18: doc/imfile: add File and Tag to parameter samples 2025-08-18: OMHIREDIS: supported UDS redis server address 2025-08-17: ommongodb: fix compilation of SSL/TLS support 2025-08-17: ommongodb: add support for mongo-c-driver v2 2025-08-17: docs: rewrite container section with current images 2025-08-17: doc: add per-container docker pages with env defaults (#5960) 2025-08-16: imjournal: fix double sdjournalclose() during thread cancellation 2025-08-16: doc: warn against unofficial and outdated doc clones 2025-08-16: doc: set htmlbaseurl to emit canonical tags 2025-08-16: Update doc/source/conf.py 2025-08-15: omhttp: migrate to OMODTX; prep for project-supported status 2025-08-15: imtcp: split input parameter docs into reference pages 2025-08-15: imtcp: fix parameter scopes and add input examples 2025-08-15: doc: omkafka SASL-from-env example + backticks doc overhaul 2025-08-15: Update tests/omprog-feedback.sh 2025-08-15: Fix transaction suspension handling for issue #2420 2025-08-14: ommysql: remove long-standing non-needed TODO item 2025-08-14: imfile: add per-file impstats counters and tests 2025-08-14: doc: split imudp parameter docs 2025-08-13: ommysql: drop global rwlockhmysql, revert a3b2983 2025-08-13: docs: split pmrfc3164 parameters into structured reference pages 2025-08-13: docs: split omelasticsearch parameters into dedicated reference pages 2025-08-13: docs: split imjournal parameter docs into dedicated reference pages 2025-08-13: doc: increase visibility of reverse DNS cache controls 2025-08-13: doc: clarify reverse DNS cache scope 2025-08-13: doc: add v8 locking note 2025-08-13: chore: document AI-generated changes 2025-08-12: doc: update to doc (improvement) strategy 2025-08-12: doc: reference AI module map in AGENTS.md and DEVELOPING.md 2025-08-12: doc: refactor imdocker module param docs into structured ref pages 2025-08-12: doc: imdocker had invalid legacy config stmt info - removed 2025-08-11: omazureeventhubs: add Doxygen docs for proton thread and flow (NFC) 2025-08-11: omamqp1: resize buffer via realloc with error handling 2025-08-11: docs: add developer page "Action Threads and Queue Engine" 2025-08-04: omazurevenethubs: fix compiler warning 2025-08-01: omysql: better doc to clarify mutex use 2025-08-01: core: migrate callback invocations to type-safe signatures 2025-08-01: Fix: Remove unsafe function pointer casting in cfsysline.c 2025-07-31: doc fix: remove doc for debug options that no longer exits 2025-07-31: core: improve inline code doc for action.[ch] 2025-07-30: parser: add checkParserInst hook for pre-registration validation 2025-07-30: doc: improve "AI First" coverage in about section 2025-07-28: ossl: Add PrioritizeSAN option to OpenSSL network stream driver 2025-07-28: imjournal: fix vulnerability in state file creation 2025-07-28: gtls: log missing certificate/key only once 2025-07-27: doc: Improve omfwd module documentation 2025-07-27: doc(omfwd): split and restructure omfwd documentation 2025-07-25: document [io]mczmq modules 2025-07-25: doc: add an initial "about" section 2025-07-25: Add Doxygen comments for czmq modules (#5865) 2025-07-24: Add sphinxcontrib-mermaid to documentation Docker image 2025-07-22: docs: add structured beginner guide under gettingstarted/ 2025-07-22: doc: introduce mermaid diagrams and modernized configuration docs 2025-07-21: doc: major restructure and content improvements 2025-07-21: doc: fix legacy conf where modern should be 2025-07-21: Add furo theme for sphinx 2025-07-20: doc: add json targets 2025-07-20: doc: Modernize documentation and tooling 2025-07-20: Add documentation build workflow 2025-07-20: Add doc build workflow for PRs 2025-07-20: Add Apache License to documentation 2025-07-19: doc: some cleanup and naming changes 2025-07-19: doc: omit footer in singlehtml builds by default 2025-07-18: rainerscript: backticks support ${VAR} and adjacent text 2025-07-18: pmrfc3164: add headerless message detection and handling 2025-07-18: doc: restore control flow notes 2025-07-18: doc: clarify action flow and add test requirement 2025-07-18: Correct connection timing computation 2025-07-17: fix: readthedocs definitions 2025-07-17: doc: provide strategy and implementation document 2025-07-17: doc: fix "edit on github" repo link 2025-07-17: doc: enable readthedocs.io support 2025-07-16: style: reformat Config Settings block with Doxygen comments 2025-07-16: style: normalize C source formatting via clang-format (PoC) 2025-07-16: omelasticsearch fix: Handle HTTP 401/403 auth errors 2025-07-16: fix mmaitag provider handling and memory safety 2025-07-16: cleanup: remove code-style tools that are no longer neeed 2025-07-16: cleanup: fix reference to "master" branch -> now "main" 2025-07-16: chore: add project-wide formatting and editor configs 2025-07-16: Fix race condition in imtcp when closing sessions 2025-07-16: Add IP address SAN support 2025-07-15: fix: Prevent redefinition warnings for syslog macros 2025-07-15: feat: introduce mmaitag PoC with Gemini AI provider (#5754) 2025-07-15: doc: add FAQ with commonly misunderstood config sequences 2025-07-15: build: mmaitag in configure disabled by default (#5797) 2025-07-15: build: adjust version tag used for daily stable build process 2025-07-15: Investigate and resolve rsyslog issue 2693 (#5793) 2025-07-14: refactor: modernize macro definitions to support formatting and clarity 2025-07-14: docs: Fix minor typos 2025-07-13: impstats: add support for Prometheus metrics output format 2025-07-12: docker: reflect new state of repo 2025-07-12: doc: document gtls intermediate cert chain 2025-07-12: doc: clarify purpose of MsgSetRawMsg side effects 2025-07-12: dev doc: add design notes to queue subsystem files 2025-07-12: Improve TLS handshake error logging (#5762) 2025-07-12: Document statsobj architecture and formats 2025-07-11: tooling: new developer tool to fix trailing spaces 2025-07-11: Fix unsafe sprintf use in Azure event hubs module (#5687) 2025-07-10: update README.md - add new AI "rsyslog Assistant" link 2025-07-08: Document native message modification plugin interface (#5757) 2025-07-08: AI tools: Add directory for future AI/ML tooling (#5758) 2025-07-06: scripting: add endswith operator to property filters and RainerScript 2025-07-06: nsdptcp fix: misleading error messages (regression from ad1fd21) 2025-07-06: imtcp: prevent double-enqueue of descriptors via inQueue flag 2025-07-06: imkmsg fix: Handle EAGAIN/EWOULDBLOCK check portably 2025-07-05: helper utils: clean up python indentation 2025-07-04: imfile: add new module/input parameter deleteStateOnFileMove 2025-06-20: imfile: some cleanup, no functional changes 2025-06-20: fix off-by-one buffer overflow 2025-06-19: tcpsrv cleanup: remove TODO line that was scheduled to be removed 2025-06-18: tcpsrv: fail to remove already-removed epoll fd is no error 2025-06-18: official containers: bump rsyslog release nbr for next cycle 2025-06-17: omsendertrack fix: memory leak in initHashTable 2025-06-17: netossl: Fix memleak in netosslpeerfingerprint 2025-06-17: doc: first omsendertrack reference manual entry 2025-06-17: Bump tj-actions/changed-files from 4 to 46 in /.github/workflows 2025-06-17: Add omsendertrack statefile tests (#5716) 2025-06-15: update developer doc to point to new rsyslog-doc location 2025-06-15: docs: document proof-of-concept status 2025-06-15: doc: fix some nits, especially in the faq section 2025-06-15: doc: add lexer for rsyslog config language 2025-06-15: cleanup: fix some TODOs and remove outdated ones 2025-06-15: Fix: Correct documentation location and update build guidance 2025-06-14: doc: improve description of config parameter block handling 2025-06-14: doc: add doxygen comments to runtime header 2025-06-13: omfile: update internal doc to doxyfile format and improve it 2025-06-13: docs: add commenting style guide and reference 2025-06-13: add new FAQ on udp reception troubleshooting 2025-06-13: Use RGerhards name in omusrmsg header 2025-06-12: ossl netstream driver: do not import engines if not available (#5685) 2025-06-12: Removed the redundant laLDFLAGS 2025-06-11: Add Makefile for Sphinx documentation 2025-06-10: prepare scheduled stable version 8.2506.0 2025-06-10: omusrmsg: use utmpx on systems where available 2025-06-10: imtcp: avoid data race in notifyReArm 2025-06-10: fix hashtable realloc memset range 2025-06-09: Revert "queue: emit better warning messages on queue param mismatch" 2025-06-08: omfwd regression fix: avoid false active target change log message 2025-06-08: lookup: add new table type for regex-matches 2025-06-08: imdocker: harden module buffer management 2025-06-08: clarify pselect suppression 2025-06-07: doc: document optional module dependencies 2025-06-07: Add optional PCRE match module 2025-06-06: fix stringop-overread warning in omusrmsg 2025-06-06: fix im3195 doc 2025-06-06: docs: unify AI commit instructions and improve setup notes 2025-06-06: docs: restructure contributor docs for clarity and AI agent readiness 2025-06-05: update README to convey new developments in this project 2025-06-05: fix mime type typo 2025-06-05: docs: clarify CI image size 2025-06-05: Update README to mirror new project organization 2025-06-05: STEP: interim new "production" docker container set 2025-06-05: Add README files for standard, dockerlogs, and host 2025-06-04: stats: add prometheus format to set of supported output formats 2025-06-04: imhttp: add simple http health check functionality 2025-06-04: hostname setting works 2025-06-04: Fix comment for parsSkipWhitespace 2025-05-23: imudp: Output errno after recvmmsg call 2025-05-15: imjournal: delete redundant lines in imklog.c 2025-05-12: netstrm: optimized interface for passing connection err info 2025-05-08: tls subsystem: generate better error message on accept failure 2025-04-24: tcpsrv: ensure thread name set via pthread is max 15 char 2025-04-24: ossl tls driver: better error reporting 2025-04-18: gnutls netstrm drvr fix: handle write retry correctly in recv call 2025-04-17: tcpsrv bugfix: do not busy wait on io events 2025-04-16: tcpsrv bugfix: input name was not properly propagated 2025-04-16: add experimental stats for worker awaking via event notification 2025-04-15: tcpsrv: fix non-maintained stats counter "run" 2025-03-25: Feature: #define macro creation for journald namespace function. 2025-03-22: omjournal: Fix priority value. 2025-03-22: Feature: Add journald namespace feature to omjournal. 2025-03-17: imuxsock: Add statistics counter for discarded messages 2025-03-14: cosmetic: remove clang static analyzer false positive 2025-03-06: omsendertrack: new module 2025-03-06: Fix a buffer overflow when the argument to replace is empty 2025-03-05: rsyslog startup bugfix: cosmetic memory leak 2025-03-05: gnutls TLS driver: fix small memory leak 2025-03-05: core: fix potential misadressing in sigmask 2025-03-03: Update man page dates 2025-03-01: omhttp: fix handling of httpProxy variable 2025-02-28: "fix" clang 18 static analyzer false positives 2025-02-27: queue: emit better warning messages on queue param mismatch 2025-02-26: core: fix potential NULL ptr access on HUP in very early startup phase 2025-02-21: bump version number for next scheduled stable cycle 2025-02-20: Fix typo in debug printf of ommysql

The tcpmssmanglepacket function in net/netfilter/xtTCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xtTCPMSS in an iptables action.

A Missing Authentication for Critical Function vulnerability in longhorn of SUSE Longhorn allows attackers to connect to a longhorn-engine replica instance granting it the ability to read and write data to and from a replica that they should not have access to. This issue affects: SUSE Longhorn longhorn versions prior to 1.1.3; longhorn versions prior to 1.2.3v.

This update for rsyslog fixes the following issues:

- CVE-2026-92709: omfile dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling, which can lead to arbitrary code execution (bsc#1286926). - RainerScript replace() length wrap (bsc#1285036).

This update for rsyslog fixes the following issues:

- CVE-2026-92709: omfile dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling, which can lead to arbitrary code execution (bsc#1286926). - RainerScript replace() length wrap (bsc#1285036).

This update for php8 fixes the following issues: Update to version 8.3.33.

Security issues fixed:

- CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion (bsc#1273077). - CVE-2026-9672: security issues in libgd (bsc#1273078). - CVE-2026-17543: improper escaping of backslashes in user-provided parameters allows for trivial SQL injection in ext-pgsql (bsc#1273075). - CVE-2026-17544: php: Out-of-bounds write in bccomp() via crafted operand and scale (bsc#1273076)

This update for rsyslog fixes the following issues:

- CVE-2026-92709: omfile dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling, which can lead to arbitrary code execution (bsc#1286926). - RainerScript replace() length wrap (bsc#1285036).

Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11,

Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11,

SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, a Fleet cluster defined in a namespace an ordinary user controls could be associated with administrative credentials for the management cluster itself, causing the controller to manage the management cluster on that user's behalf and to run that user's Fleet content there with elevated privileges. This affects SUSE Rancher Fleet 0.16.0 up to 0.16.3, 0.15.0 up to 0.15.8, 0.14.0 up to 0.14.12, 0.13.0 up to 0.13.17 and possible older versions.

This update for rsyslog fixes the following issues:

- CVE-2026-92709: omfile dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling, which can lead to arbitrary code execution (bsc#1286926). - RainerScript replace() length wrap (bsc#1285036).

This update for python-Pillow fixes the following issues:

- CVE-2026-96636: decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (bsc#1286802). - CVE-2026-96637: decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS (bsc#1286801). - CVE-2026-96640: PDF append accepts malformed shared page-tree DAG, which can cause resource exhaustion (bsc#1286798). - CVE-2026-96641: reachable undefined behavior in native integer operations can lead to denial of service or logic integrity compromise (bsc#1286797). - CVE-2026-96642: TarIO negative size field causes infinite CPU-spin loop (bsc#1286796). - CVE-2026-112390: Denial of Service via infinite loop during crafted MIC image parsing (bsc#1286256). - CVE-2026-112391: Denial of Service via unbounded recursion in PDF parser (bsc#1286273). - CVE-2026-112392: Denial of Service via zero-size images in rank filters (bsc#1286287). - CVE-2026-112393: heap buffer overflow and stale-heap disclosure in tiffWriteProc when saving compressed TIFF data (bsc#1286325). - CVE-2026-112394: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size (bsc#1286311). - CVE-2026-112397: out-of-bounds access in imagingmorph on a zero-width image (bsc#1286314). - CVE-2026-112398: heap buffer overflow in FPX JPEG decoding can lead to code execution (bsc#1286406). - CVE-2026-112399: Denial of service via crafted APNG image (bsc#1286368). - CVE-2026-112400: Denial of Service via memory exhaustion from crafted GIF image (bsc#1286370). - CVE-2026-112401: Denial of Service via crafted GIF comments (bsc#1286372). - CVE-2026-112402: Denial of service via double free during image transformation (bsc#1286381). - CVE-2026-112403: heap buffer overflow in ImagingJpegDecode allows for code execution (bsc#1286405). - CVE-2026-112405: NULL pointer dereference in Image.merge via an unvalidated band 0 (bsc#1286404). - CVE-2026-112406: infinite loop in PdfParser.rewritepages on page tree Parent cycle (bsc#1286403). - CVE-2026-112891: quadratic GIF comment copying during save (bsc#1286402). - CVE-2026-112892: MSP RLE decoder expands a tiny file into unbounded memory (bsc#1286401). - CVE-2026-112894: Denial of Service via crafted multi-frame image conversion (bsc#1286408). - CVE-2026-112895: Denial of service via crafted PDF during append operations (bsc#1286411). - CVE-2026-112896: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read (bsc#1286400). - CVE-2026-112897: TiffDecode returns uninitialized memory as pixels for short JPEG strips (bsc#1286398). - CVE-2026-112899: EPS load(scale) lets Ghostscript render past the decompression bomb limit (bsc#1286489). - CVE-2026-112900: argument Injection in Ghostscript call can lead to remote code execution (bsc#1286397). - CVE-2026-112901: ReDoS in XbmImagePlugin can be triggered by 512-byte file (bsc#1286396). - CVE-2026-112902: memory disclosure and segfault in libtiff encoder via crafted TIFF tags (bsc#1286804).

An attacker can leverage sudo's -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file. Sudo versions 1.9.14 to 1.9.17 inclusive are affected.

Mozilla developers and community members Andreea Pavel, Christian Holler, Honza Bambas, Jason Kratzer, and Jeff Gilbert reported memory safety bugs fixed in Firefox 68, Firefox ESR 60.8, and Thunderbird 68. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code.

This update for perl-Cpanel-JSON-XS fixes the following issues:

- CVE-2025-40929: integer overflow (bsc#1249331). - CVE-2026-9334: type confusion via duplicate object keys when dupkeysasarrayref is enabled (bsc#1267546). - CVE-2026-9516: denial of service via UTF-8 BOM prefixed input when a decode filter callback throws (bsc#1267547). - CVE-2026-110672: leak of decoded key of an object rejected for a duplicate key or a missing colon in decodehv (bsc#1286166). - CVE-2026-110673: stack exhaustion via nested tagged values under allowtags in decodetag (bsc#1286167). - CVE-2026-110674: duplicate non-ASCII bare keys are missed, allowing type confusion under dupkeysasarrayref in decodehv (bsc#1286168). - CVE-2026-110675: malformed UTF-8 accepted in bare hash keys under allowbarekey in decodehv (bsc#1286169). - CVE-2026-110676: memory exhaustion by encoding exponent notation as full decimal digits under allowbignum (bsc#1286170). - CVE-2026-110677: array collecting duplicate key values leaked under dupkeysasarrayref in decodehv (bsc#1286173). - CVE-2026-110678: memory exhaustion by buffering incremental input past maxsize in incrparse (bsc#1286174). - CVE-2026-110680: out-of-bounds write when a tied or shared hash grows during canonical encoding in encodehv (bsc#1286175). - CVE-2026-110681: parent interpreter's scalars from a parser object cloned into a new ithread (bsc#1286176). - CVE-2026-110682: input chunking can change the decoded value of top-level numbers in incrparse (bsc#1286177). - CVE-2026-110684: memory leaked and overloaded objects retained when encoding values as strings in encodestringify (bsc#1286179). - CVE-2026-110685: decoded arguments of a tagged value leaked when its THAW method dies in decodetag (bsc#1286180). - CVE-2026-110686: freed filter callbacks used when a filter removes itself during decoding in decodehv (bsc#1286181). - CVE-2026-110687: byte-string keys misordered during canonical encoding in utf16cmp (bsc#1286182). - CVE-2026-110688: quadratic CPU use due to remaining buffer revalidation per value in incrparse (bsc#1286183).

Changes for perl-Cpanel-JSON-XS:

- updated to 4.800.0 (4.80) - Add version markers to all module files. (PR #260 demerphq) - Use utf8ntouvchr on Perl 5.32 and later to avoid the deprecated utf8ntouvuni API. (PR #260 demerphq) - Add schema-based validation for decoded JSON (GH #238): Cpanel::JSON::XS::Type now provides checktype($data, $schema[, $foundtype]), which validates an already-decoded perl structure against a type spec built from the existing encoder building blocks (JSONTYPE / jsontypearrayof / jsontypehashof / jsontypeanyof), plus the new jsontypeoptional() for hash keys that may be absent, and short scalar type name sugar ('Str', 'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.) so a schema reads as 'just a hash of keys and types', as requested. Unlike the encoder's hash type spec, a plain hashref schema is closed: unknown keys and missing required keys are reported. New $json->decodeandvalidate($jsontext, $schema) method decodes and croaks with all mismatches if validation fails, using decode()'s own type introspection as ground truth to avoid perl's usual dual-var/stringified-number ambiguity. - jsontypeoptional() and the nullable '?' type-name suffixes ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way to declare a key/value as optional instead of demanding a complete type specification for every key. The encoder now also understands jsontypeoptional() directly (it unwraps to the wrapped type, since encode() only ever sees keys that are actually present): the exact same type spec built for checktype()/decodeandvalidate() can now be handed to encode() as-is, instead of croaking with 'no type was specified for hash key '...'' for every optional key. Encoding stays strict by default otherwise: a hash key with no entry at all in the type spec still croaks (GH #242). eg/benchlarge.pl: old encode: 20.5--22.9/s decode: 16.2--16.5/s for 4.53 new encode: 21.1--22.5/s decode: 15.7--16.3/s for 4.80 4.53 2026-09-28 (rurban) - Fix C90 violations with arm neon (GH #258 rjbs) - Added a native arm64 test runner. - updated to 4.520.0 (4.52) 4.52 2026-09-12 (rurban) - OSX 10.9 fix for SIMD UTF-8 (Christian Carey) - Change my maintainer email to reini.urban@gmail.com 4.51 2026-09-11 (rurban) - Add faster SIMD UTF-8 validation (GH #213, Zhang Boyang) - Fix tests for yath (GH #255, with H.Merijn Brand): the test files now work with Test2::Harness instead of only Test::Harness, and a yath run is added to make xtest when yath is installed. - Skip one t/117numbers.t test on Perls with 32-bit IVs (GH #254, Jeremy Hansen). 4.50 2026-09-08 (rurban) - Add $json->encodeto($fh, $data, [$type]) to stream encoded JSON directly to a filehandle instead of building the whole result in memory (GH #250, requested by yairlenga. designed 2016 in GH #58). Internally flushes a bounded 8k chunk buffer as it fills, keeping peak memory bounded for large data structures. - Encoder performance improvements suggested in GH #237 (17dec): Large-integer encoding now uses a 100-digit lookup table instead of snprintf, roughly 2x faster for integers outside the existing branchless small-integer fast path (|value| > 59000). encodestr now bulk-copies runs of consecutive bytes that need no escaping instead of a need()+store per byte, notably faster for strings with few or no characters to escape. Added eg/benchlarge.pl with results. - updated to 4.440.0 (4.44) 4.44 2026-09-02 (rurban) - Fix canonical sort infinite loop (GH #252 amelchio): malformed UTF-8 keys (e.g. Latin-1 byte strings mixed with Unicode) made utf16cmp treat the decoder's (STRLEN)-1 malformed sentinel as a length, wrapping the buffer pointer. Now checked as 0 or > remaining length. - updated to 4.430.0 (4.43) 4.43 2026-07-18 (rurban) - Fix canonical sort: compare by UTF-16 code units per RFC 8785 (GH #248, leont) - Fix canonical sort on Perl 5.8-5.18: utf16cmp now always attempts UTF-8 decoding instead of checking SvUTF8 flag, since older Perls may store valid UTF-8 hash keys without the flag set. - Fix quadmath encode dropping '.0' for large floats (GH #246, reported by Tux). The .0 guard condition that suppressed appending for NV values > UVMAX was incorrect on high-precision FP (quadmath, 128-bit long double on arm64) where %g uses fixed-point notation for values like 1.01e30. Guarded with #if NVDIG < 31 to skip only on double/80-bit-ld where %g naturally uses %e for large values. - updated to 4.420.0 (4.42) 4.42 2026-06-27 (rurban) - Ensure encode with a type spec hashref does not change the hashref argument (GH #240) - Fix -e docs: 'written' -> 'read' (GH #239, reported by Ron Savage). - Fix Boolean eq overload matching undef (GH #207, reported by fd-t). Cpanel::JSON::XS::Boolean overloaded eq would match undef as equal to false because undef stringifies to ''. Added defined() guard. - Fix error messages showing overloaded stringification for blessed objects (GH #191, reported by karenetheridge). Error messages now use ClassName=TYPE(addr) format, bypassing any '' overload. - Fix typeallstring overriding allowblessed/convertblessed (GH #175, reported by alpha6). With typeallstring + allowblessed, blessed objects are now encoded as null (not stringified as HASH address). - Fix infinite recursion when encode is called from a '' overload (GH #128, reported by pbrthemaster). The recursion guard temporarily clears convertblessed and allowstringify flags on the JSON object before calling the overload, preventing re-entrant encode loops. - Fix $obj->new creating a broken object (GH #93, reported by cpansprout). When new() is called on an existing object (e.g. $json->new->new), the class name is now extracted from the object's stash rather than using the stringified reference. - Change allownonref default to true (GH #241, matching JSON::PP and JSON::XS 4.0+ and the insecure RFC 7159). encode and decode now accept non-reference values by default. decodejson() with an explicit 0/1 second argument still works. allownonref(0) to disable scalars-only for secure JSON. - Fix minor t/12blessed.t typo. - Fix GH #112: encode large whole-number NV values without .0 on 32-bit Perl (values exceeding UVMAX that Perl stores as float). - Fix GH #197: prefer IOK over pNOK when encoding values where IV is accurate but NV is imprecise (SvNOK not set). - updated to 4.410.0 (4.41) 4.41 2026-05-27 (rurban) - Fix incrparse single-quote string delimiter (GH #245, reported by Paul Johnson) - Fix a one-byte out-of-bounds heap read reachable via allowbarekey on truncated input (GH #244, reported by Paul Johnson) - updated to 4.400.0 (4.40) 4.40 2025-09-07 (rurban) - Fix CVE-2025-40929 overflow with overlong numbers, fuzzing only. - Detect more malformed numbers, with two decimal points. - Pin github actions to latest @v via pinact run -u (bsc#1249331) - updated to 4.390.0 (4.39) 4.39 2024-12-12 (rurban) - Fix Windows -Dusequadmath (sisyphus GH #235, GH #229) - Fix inconsistent behavior between decoding escaped and unescaped surrogates, and escaped non-characters vs non-escaped non-characters. Now aligned to JSON::PP (Gavin Hayes GH #233, GH #227) - Add typeallstring tests (Bernhard Schmalhofer GH #236) - Silence UV to char cast warnings (bulk88 GH #232) - Fix MSVC preprocessor errors (bulk88 GH #232) - Fix -Wformat warnings on Windows (sisyphus GH #228) - Clarify BigInt decoding (GH #226)

Impact

A vulnerability has been identified which enables Standard users or above to elevate their permissions to Administrator in the local cluster.

The local cluster means the cluster where Rancher is installed. It is named local inside the list of clusters in the Rancher UI.

Standard users could leverage their existing permissions to manipulate Kubernetes secrets in the local cluster, resulting in the secret being deleted, but their read-level permissions to the secret being preserved. When this operation was followed-up by other specially crafted commands, it could result in the user gaining access to tokens belonging to service accounts in the local cluster.

Users that have custom global roles which grant create and delete permissions on secrets would also be able to exploit this vulnerability.

Users with audit logs enabled in Rancher can try to identify possible abuses of this issue by going through the logs. To sieve through the data filter by kind: Secret with type: provisioning.cattle.io/cloud-credential, then investigate all log entries that affect that specific resource. A secondary check would be to filter by all operations with Opaque Secrets within the cattle-global-data namespace.

After patching, it is recommended that users review access methods to Rancher (including RBAC policies, tokens, and host-level node access), to ensure that no changes were made to persist access to users who have leveraged this vulnerability.

Patches

Patched versions include releases 2.6.13, 2.7.4 and later versions.

Workarounds

There is no direct mitigation besides updating Rancher to a patched version.

For more information

If you have any questions or comments about this advisory:

- Reach out to the SUSE Rancher Security team for security related inquiries. - Open an issue in the Rancher repository. - Verify with our support matrix and product support lifecycle.

ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.