CVE-2026-61548: Rsyslog Buffer Overflow Vulnerability

CVE-2026-61548 Overview

CVE-2026-61548 is a stack-based buffer overflow [CWE-121] in the optional mmpstrucdata plugin of Rsyslog. The flaw affects versions from 7.5.4 up to (but not including) 8.2606.0. The parseSD_PARAM function in plugins/mmpstrucdata/mmpstrucdata.c stores RFC5424 structured-data parameter values in a fixed pVal[32 * 1024] stack buffer. It calls parsePARAM_VALUE without supplying the destination buffer size. A remote unauthenticated attacker can send a crafted RFC5424 message that reaches an action using mmpstrucdata and overflow the stack buffer when MaxMessageSize allows a larger payload.

Critical Impact
A remote unauthenticated attacker can trigger an attacker-controlled stack overwrite in Rsyslog, crashing the daemon and interrupting log collection across affected deployments.

Affected Products

Rsyslog versions 7.5.4 through 8.2605.x
Deployments loading the optional mmpstrucdata plugin
Configurations with MaxMessageSize set above the vulnerable threshold

Discovery Timeline

2026-09-18 - CVE-2026-61548 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-61548

Vulnerability Analysis

Rsyslog is a high-performance syslog processor used broadly across Linux distributions and log collection pipelines. The mmpstrucdata message-modification plugin parses RFC5424 structured-data (SD) elements into the JSON variable tree so downstream actions can operate on individual SD parameters. The parsing routine parseSD_PARAM allocates a 32 KB automatic (stack) buffer named pVal to hold each parameter value and then invokes parsePARAM_VALUE to copy content into it. The call omits the destination-size argument, so no bounds check is performed against the fixed 32 KB capacity. When the effective MaxMessageSize directive permits messages larger than the buffer, a single oversized SD parameter overwrites adjacent stack memory, including saved return addresses and frame pointers.

The demonstrated impact is a daemon crash and loss of log ingestion. Code execution has not been demonstrated publicly, though stack-based overwrites of this class are historically leveraged for control-flow hijacking on systems without stack canaries or with weakened mitigations.

Root Cause

The root cause is a missing length argument in the call chain between parseSD_PARAM and parsePARAM_VALUE. The destination buffer size is known at compile time (32 * 1024), but the copy helper is invoked as though the destination were unbounded. This is a classic instance of [CWE-121] where trust in upstream size limits (in this case, the default MaxMessageSize) is not enforced at the copy site.

Attack Vector

Exploitation requires that a crafted RFC5424 syslog message reaches an Rsyslog action pipeline containing mmpstrucdata. The attacker sends a syslog message whose structured-data segment contains a single SD parameter value larger than 32 KB. Any transport accepted by the target - UDP, TCP, or RELP on the syslog listener - is a viable delivery channel. Because Rsyslog frequently ingests logs from network-reachable sources, the vulnerability is remotely triggerable without authentication when the plugin is loaded and MaxMessageSize is raised above the default.

The upstream patch adds a maxstructureddatasize parameter and support for custom SD containers, capping the amount of structured data processed. Fix commit: rsyslog/rsyslog@bcda60a.

text

     source/reference/parameters/mmpstrucdata-jsonroot.rst \
+    source/reference/parameters/mmpstrucdata-container.rst \
+    source/reference/parameters/mmpstrucdata-maxstructureddatasize.rst \
     source/reference/parameters/mmpstrucdata-sd_name.lowercase.rst \

Source: GitHub Commit bcda60a

Detection Methods for CVE-2026-61548

Indicators of Compromise

Unexpected termination or repeated restarts of the rsyslogd process on log collectors
Gaps or truncation in centralized log streams from hosts running vulnerable Rsyslog builds
Core dumps referencing parseSD_PARAM or parsePARAM_VALUE frames in mmpstrucdata.so
Inbound syslog packets containing RFC5424 SD parameter values exceeding 32 KB

Detection Strategies

Inventory hosts running Rsyslog and identify configurations that load mmpstrucdata (module(load="mmpstrucdata")) alongside a raised $MaxMessageSize.
Inspect ingress syslog traffic for RFC5424 messages with oversized SD parameter values, particularly single tokens above 32 KB.
Correlate rsyslogd service crashes and systemd restart events with preceding syslog ingest spikes.

Monitoring Recommendations

Alert on rsyslogd segmentation faults and abnormal exit codes reported by systemd or the kernel audit subsystem.
Monitor log-collector uptime and ingestion throughput to detect silent gaps caused by daemon crashes.
Capture and review network flow data on syslog listeners (UDP/514, TCP/514, RELP/2514) for anomalous message sizes.

How to Mitigate CVE-2026-61548

Immediate Actions Required

Upgrade Rsyslog to version 8.2606.0 or later on all hosts that load the mmpstrucdata plugin.
Audit Rsyslog configurations and remove mmpstrucdata from action pipelines where structured-data parsing is not required.
Lower $MaxMessageSize below the 32 KB threshold on collectors where the plugin cannot be removed prior to patching.
Restrict syslog listener exposure to trusted network segments and authenticated sources.

Patch Information

The fix ships in Rsyslog 8.2606.0. See the GitHub Release v8.2606.0 and the GHSA-8qmr-c66f-g368 advisory for full remediation details. The upstream fix commit is tracked in pull request #6991 and coordinated disclosure was announced on the Openwall OSS-Security list.

Workarounds

Unload the mmpstrucdata module until an upgrade to 8.2606.0 is possible.
Keep $MaxMessageSize at or below the default value so oversized SD parameters are truncated before parsing.
Terminate untrusted syslog feeds at a filtering relay that enforces message-size ceilings before forwarding to vulnerable collectors.

bash

# Temporary mitigation: disable mmpstrucdata and cap message size in /etc/rsyslog.conf
# module(load="mmpstrucdata")   # comment out until patched
$MaxMessageSize 8k

# Apply and verify
sudo systemctl restart rsyslog
sudo systemctl status rsyslog
rsyslogd -N1