CVE-2026-55556: Rsyslog imhttp Module DOS Vulnerability

CVE-2026-55556 Overview

CVE-2026-55556 is a heap-based buffer overflow [CWE-122] in the Rsyslog imhttp module. The flaw resides in the parse_auth_header function within contrib/imhttp/imhttp.c. When an HTTP Basic Authorization header exceeds the fixed work buffer, the function calls calloc(0, len), allocating a zero-byte heap buffer. The pointer is then passed to apr_base64_decode, which writes decoded data past the allocation boundary. An unauthenticated remote attacker can trigger the overflow by sending oversized encoded credentials to an imhttp endpoint configured for Basic Authentication. The confirmed impact is a process crash that interrupts log collection. Versions 8.2110.0 through 8.2603.x are affected, and the issue is fixed in 8.2604.0.

Critical Impact
Unauthenticated remote attackers can corrupt heap memory in the Rsyslog daemon, crashing the logging service and disrupting downstream security telemetry.

Affected Products

Rsyslog versions 8.2110.0 through 8.2603.x with the optional imhttp module loaded
Deployments using imhttp with Basic Authentication configured
Fixed in Rsyslog version 8.2604.0

Discovery Timeline

2026-09-18 - CVE-2026-55556 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-55556

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow in the input HTTP module (imhttp) shipped with Rsyslog. The parse_auth_header function in contrib/imhttp/imhttp.c handles HTTP Basic Authorization headers submitted to an imhttp endpoint. When an incoming authorization value exceeds the size of a fixed-size internal work buffer, the code falls back to a heap allocation. That allocation is made using calloc(0, len), which returns a pointer to a zero-byte region rather than the expected len bytes.

The zero-length pointer is then handed to apr_base64_decode, which decodes the attacker-controlled Base64 credential and writes the output past the end of the allocation. The write occurs before any credential validation runs, so no authentication is required to reach the vulnerable path. Only deployments that install, load, and use imhttp with Basic Authentication are affected.

Root Cause

The root cause is an incorrect argument order or logic error in the calloc call, which multiplies zero by the requested length and produces a zero-byte allocation. The decoder does not receive or enforce a destination buffer length, so it trusts the pointer and copies the full decoded payload into adjacent heap memory.

Attack Vector

The attack vector is remote and unauthenticated. An attacker sends a single HTTP request to an imhttp listener with an oversized Base64-encoded value in the Authorization: Basic header. The oversized value forces the vulnerable heap path, and the decoded bytes overwrite adjacent heap chunks, resulting in a crash of the Rsyslog daemon. Code execution has not been demonstrated in public research.

text

# Patch context from Rsyslog commit acde2ba25ea33816694b787859f4a727a247b6d6
# imhttp: add route-scoped API key authentication

+    source/reference/parameters/imhttp-apikeyfile.rst \
+    source/reference/parameters/imhttp-basicauthfile.rst \
+    source/reference/parameters/imhttp-healthcheckapikeyfile.rst \
+    source/reference/parameters/imhttp-healthcheckbasicauthfile.rst \
+    source/reference/parameters/imhttp-metricsapikeyfile.rst \
+    source/reference/parameters/imhttp-metricsbasicauthfile.rst \

Source: GitHub Commit acde2ba

Detection Methods for CVE-2026-55556

Indicators of Compromise

Unexpected crashes or restarts of the rsyslogd process on hosts exposing imhttp listeners
Core dumps or SIGSEGV entries in journalctl -u rsyslog correlating with inbound HTTP traffic
Inbound HTTP requests to imhttp endpoints containing Authorization: Basic headers with unusually long Base64 payloads
Gaps in log ingestion or missing downstream events from hosts that forward logs via imhttp

Detection Strategies

Inspect HTTP request telemetry at reverse proxies or WAFs for Authorization: Basic headers exceeding several kilobytes
Monitor Rsyslog process health, restart counts, and abnormal memory behavior
Correlate Rsyslog daemon crashes with concurrent inbound requests to any imhttp-bound port

Monitoring Recommendations

Enable process and service monitoring for rsyslogd availability and restart frequency
Capture and centralize imhttp access logs for review of oversized authorization headers
Alert on the disappearance of expected log sources that rely on imhttp collection

How to Mitigate CVE-2026-55556

Immediate Actions Required

Upgrade Rsyslog to version 8.2604.0 or later on all systems that load the imhttp module
Inventory hosts to confirm whether imhttp is loaded and whether Basic Authentication is enabled
Restrict network access to imhttp listeners to trusted management networks until patching is complete
Enable process auto-restart for rsyslogd to reduce the window of log collection outage if crashes occur

Patch Information

The fix is included in Rsyslog v8.2604.0. Details are available in the GitHub Security Advisory GHSA-947w-69ph-mc2r, the Rsyslog v8.2604.0 release notes, the upstream commit, and the Openwall OSS-Security post.

Workarounds

Unload the imhttp module in rsyslog.conf if HTTP input is not required
Disable Basic Authentication on imhttp endpoints and rely on network-level access controls
Place a reverse proxy in front of imhttp that enforces a maximum Authorization header size
Restrict inbound traffic to imhttp ports using host or network firewall rules

bash

# Example: remove imhttp module load and restart rsyslog
sudo sed -i '/module(load="imhttp")/d' /etc/rsyslog.conf
sudo systemctl restart rsyslog

# Verify installed version is 8.2604.0 or later
rsyslogd -v | head -n 1