CVE-2026-78002Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function

Description

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.

Timeline

Scores

EPSS (exploitation in 30 days)

1.1% · top 35% of all CVEs (13 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Affected products

• Red Hat · Red Hat Enterprise Linux 10

  • unaffected 0:8.2510.0-5.el10_2.2 – < *

• Red Hat · Red Hat Enterprise Linux 10

  • unaffected 0:8.2604.0-5.el10_3.1 – < *

• Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Support

  • unaffected 0:8.2412.0-1.el10_0.2 – < *

• Red Hat · Red Hat Enterprise Linux 7 Extended Lifecycle Support

  • unaffected 0:8.24.0-57.el7_9.4 – < *

• Red Hat · Red Hat Enterprise Linux 8

  • unaffected 0:8.2102.0-15.el8_10.3 – < *

• Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

  • unaffected 0:8.1911.0-7.el8_4.5 – < *

• Red Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

  • unaffected 0:8.1911.0-7.el8_4.5 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

  • unaffected 0:8.2102.0-7.el8_6.2 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

  • unaffected 0:8.2102.0-7.el8_6.2 – < *

• Red Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update Service

  • unaffected 0:8.2102.0-13.el8_8.1 – < *

• Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

  • unaffected 0:8.2102.0-13.el8_8.1 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:8.2510.0-2.el9_8.2 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:8.2604.0-4.el9_9.1 – < *

• Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

  • unaffected 0:8.2102.0-113.el9_2.3 – < *

• Red Hat · Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

  • unaffected 0:8.2310.0-4.el9_4.2 – < *

• Red Hat · Red Hat Enterprise Linux 9.6 Extended Update Support

  • unaffected 0:8.2412.0-1.el9_6.2 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1790241900 – < *

• Red Hat · Red Hat Enterprise Linux 6

  All versions: unaffected

• Red Hat · Red Hat Enterprise Linux 6

  All versions: unaffected

What to do

Workaround: To mitigate this vulnerability, restrict network access to the rsyslog service to only trusted hosts. This can be achieved by configuring firewall rules to limit incoming connections to UDP and TCP port 514. Alternatively, if remote syslog reception is not required, disable the `imudp` and `imtcp` modules in the `/etc/rsyslog.conf` configuration file. After modifying the rsyslog configuration or firewall rules, the rsyslog service or firewall service must be restarted for the changes to take effect.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-67085 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-78002](https://cveledger.app/badge/CVE-2026-78002.svg)](https://cveledger.app/cve/CVE-2026-78002)

Record last updated 11 Nov 2026, 12:49 UTC.