CVE-2026-19654

Published: Ago 12, 2026 Last Modified: Ago 12, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high

Description

AI Translation Available

A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.

125

Out-of-bounds Read

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Availability Other
Potential Impacts:
Read Memory Bypass Protection Mechanism Dos: Crash, Exit, Or Restart Varies By Context
Applicable Platforms
Languages: Memory-Unsafe, C, C++
Technologies: ICS/OT
View CWE Details
https://access.redhat.com/security/cve/CVE-2026-19654
https://access.redhat.com/security/cve/CVE-2026-19654
https://bugzilla.redhat.com/show_bug.cgi?id=2502868
https://bugzilla.redhat.com/show_bug.cgi?id=2502868
https://github.com/rsyslog/rsyslog/security/advisories/GHSA…
https://github.com/rsyslog/rsyslog/security/advisories/GHSA-cj5r-wh2m-7w29