RS
Product
rsyslog
21
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 4High 6Medium 4Low 0
Watch
Add rsyslog to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-17042 | 9.8 | Oct 7 | An issue was discovered in Rsyslog v8.1908.0 Affected: 8.1908.0 |
| CVE-2019-17041 | 9.8 | Oct 7 | An issue was discovered in Rsyslog v8.1908.0 Affected: 8.1908.0 |
| CVE-2019-17040 | 9.8 | Sep 30 | contrib/pmdb2diag/pmdb2diag.c in Rsyslog v8.1908.0 allows out-of-bounds access because the level length is mishandled Affected: 8.1908.0 |
| CVE-2017-12588 | 9.8 | Aug 6 | The zmq3 input and output modules in rsyslog before 8.28.0 interpreted description fields as format strings, possibly allowing a format string attack with unspecified impact Affected: through 8.27.0 |
| CVE-2026-55556 | 8.2 | Sep 18 | Rsyslog: Heap buffer overflow in imhttp plugin Basic Authentication handling Affected: >= 8.2110.0, < 8.2604.0 |
| CVE-2026-92709 New | 8.1 | Oct 22 | Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE Affected: >= 1.15.0, <= 8.2610.0 |
| CVE-2026-61548 | 8.1 | Sep 18 | Rsyslog: mmpstrucdata stack buffer overflow with oversized RFC5424 structured data Affected: >= 7.5.4, < 8.2606.0 |
| CVE-2022-24903 | 8.1 | May 6 | Rsyslog is a rocket-fast system for log processing Affected: before 8.2204.1 |
| CVE-2026-19654 | 7.5 | Aug 12 | Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd Affected: 8.36.0 before 8.2608.0 |
| CVE-2018-16881 | 7.5 | Jan 25 | A denial of service vulnerability was found in rsyslog in the imptcp module Affected: before 8.27.0 |
| CVE-2011-1490 | 5.5 | Nov 14 | A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when multiple rulesets were used and some output batches contained messages… Affected: before 5.7.6 |
| CVE-2011-1489 | 5.5 | Nov 14 | A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages were logged when multiple rulesets were used and some output batches contained messages… Affected: before 5.7.6 |
| CVE-2011-1488 | 5.5 | Nov 14 | A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when $RepeatedMsgReduction was enabled Affected: before 5.7.6 |
| CVE-2015-3243 | 5.5 | Jul 25 | rsyslog uses weak permissions for generating log files, which allows local users to obtain sensitive information by reading files in /var/log/cron Affected: All versions, or not specified |
| CVE-2014-3683 | – | Nov 2 | Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI)… Affected: through 7.6.6; 8.1.0; 8.1.1; 8.1.2; 8.1.3; 8.1.4; +14 more |
| CVE-2014-3634 | – | Nov 2 | rsyslog before 7.6.6 and 8.x before 8.4.1 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash), possibly execute arbitrary code, or have other… Affected: through 7.6.5; 8.1.0; 8.1.1; 8.1.2; 8.1.3; 8.1.4; +13 more |
| CVE-2013-4758 | – | Oct 4 | Double free vulnerability in the writeDataError function in the ElasticSearch plugin (omelasticsearch) in rsyslog before 7.4.2 and before 7.5.2 devel, when errorfile is set to… Affected: through 7.4.1; through 7.5.1; 6.4.2; 6.5.1; 6.6.0; 7.1.0; +34 more |
| CVE-2011-4623 | – | Sep 25 | Integer overflow in the rsCStrExtendBuf function in runtime/stringbuf.c in the imfile module in rsyslog 4.x before 4.6.6, 5.x before 5.7.4, and 6.x before 6.1.4 allows local users… Affected: 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.4; 4.1.5; +34 more |
| CVE-2011-3200 | – | Sep 6 | Stack-based buffer overflow in the parseLegacySyslogMsg function in tools/syslogd.c in rsyslogd in rsyslog 4.6.x before 4.6.8 and 5.2.0 through 5.8.4 might allow remote attackers… Affected: 4.6.0; 4.6.1; 4.6.2; 4.6.3; 4.6.4; 4.6.5; +34 more |
| CVE-2008-5618 | – | Dec 17 | imudp in rsyslog 4.x before 4.1.2, 3.21 before 3.21.9 beta, and 3.20 before 3.20.2 generates a message even when it is sent by an unauthorized sender, which allows remote… Affected: 3.12.1; 3.20.0; 4.1.0; 4.1.1 |
| CVE-2008-5617 | – | Dec 17 | The ACL handling in rsyslog 3.12.1 to 3.20.0, 4.1.0, and 4.1.1 does not follow $AllowedSender directive, which allows remote attackers to bypass intended access restrictions and… Affected: 3.12.1; 3.12.2; 3.12.3; 3.12.4; 3.12.5; 3.13.0; +22 more |
Showing 21