CVE-2026-19654 Overview
CVE-2026-19654 is a denial-of-service vulnerability in the optional imptcp module of rsyslog. An unauthenticated remote peer can crash the rsyslogd daemon by sending a crafted input sequence during oversize-frame recovery. The malformed input produces an invalid internal message length, which terminates the logging daemon. The flaw is classified as an out-of-bounds read [CWE-125] affecting availability only. The imtcp module and the default imptcp framing modes are not affected. No confidentiality or integrity impact, privilege escalation, or code execution has been identified.
Critical Impact
A single crafted TCP payload from an unauthenticated remote attacker can terminate rsyslogd, disrupting centralized log collection and downstream detection pipelines that depend on syslog ingestion.
Affected Products
- Rsyslog with the optional imptcp input module enabled
- Red Hat Enterprise Linux distributions shipping affected rsyslog builds (see Red Hat advisory)
- Downstream Linux distributions that package rsyslog with imptcp support
Discovery Timeline
- 2026-08-12 - CVE-2026-19654 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-19654
Vulnerability Analysis
Rsyslog is a widely deployed high-performance log processing daemon. The imptcp module provides plain TCP syslog reception with performance optimizations over the standard imtcp input. The vulnerability resides in the oversize-frame recovery path of imptcp, which is engaged when incoming framed messages exceed configured size limits.
During this recovery routine, an attacker-controlled sequence of bytes can lead the module to compute an invalid internal message length. The corrupt length value drives a subsequent out-of-bounds read that the daemon cannot survive, terminating rsyslogd. Because syslog receivers are typically exposed to internal network segments or, in some deployments, to the internet, any peer able to establish a TCP connection to the listener can trigger the crash without credentials.
The practical consequence is loss of log ingestion. When rsyslogd terminates, hosts and network devices forwarding syslog lose their central collector, and detection content that depends on that telemetry stops firing until the daemon is restarted.
Root Cause
The root cause is improper length handling in the imptcp oversize-frame recovery logic, tracked as [CWE-125] Out-of-bounds Read. Recovery code accepts a crafted input sequence and derives an internal message length that is not validated against buffer bounds before the daemon reads from memory using that length.
Attack Vector
Exploitation requires network access to a TCP port bound by an imptcp listener and the use of a non-default imptcp framing mode. The attacker sends a crafted frame that exceeds configured limits, then a follow-on sequence that manipulates the recovery state. No authentication, user interaction, or prior foothold is required. The default imptcp framing modes and the imtcp module are unaffected.
See the GitHub Rsyslog Security Advisory and the Red Hat CVE-2026-19654 Advisory for authoritative technical details.
Detection Methods for CVE-2026-19654
Indicators of Compromise
- Unexpected termination or repeated restart of the rsyslogd process on hosts running imptcp listeners.
- Gaps in centralized syslog ingestion coinciding with inbound TCP traffic from unusual source addresses.
- Systemd journal entries showing rsyslogd exit or crash events (systemctl status rsyslog, journalctl -u rsyslog).
Detection Strategies
- Monitor process lifecycle events for rsyslogd and alert on unplanned exits or crash-loop restart patterns.
- Inspect connections to TCP ports handled by imptcp for oversized frames or malformed framing headers preceding a daemon crash.
- Correlate loss of expected syslog volume from forwarders with concurrent inbound connections to the collector.
Monitoring Recommendations
- Track availability of the log pipeline with heartbeat events and alert when ingestion stops for a defined interval.
- Enable auditd rules for rsyslogd service state transitions and record source IPs of active TCP sessions at time of crash.
- Baseline normal imptcp peer addresses and flag connections from unexpected networks.
How to Mitigate CVE-2026-19654
Immediate Actions Required
- Inventory hosts that load the imptcp module and identify those using non-default framing modes.
- Apply vendor updates for rsyslog from Red Hat and other distributions as soon as fixed packages are available.
- Restrict network reachability of imptcp listener ports to trusted log forwarders using host firewalls or network ACLs.
- Configure the rsyslog service unit to auto-restart on failure to shorten availability gaps while patching is in progress.
Patch Information
Refer to the Red Hat CVE-2026-19654 Advisory and Red Hat Bug Report #2502868 for package availability. Upstream fixes are tracked in the GitHub Rsyslog Security Advisory. Update to the fixed rsyslog version published by your distribution and restart the rsyslog service after installation.
Workarounds
- Switch affected inputs from imptcp to imtcp, which is not affected by this flaw.
- Revert to the default imptcp framing modes, which are not affected, if a non-default framing mode is not required.
- Place syslog collectors behind a segmented management network and block inbound TCP from untrusted sources to the listener port.
- Ensure Restart=on-failure is set in the rsyslog systemd unit to minimize collection downtime until a fixed package is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
