A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module.

CVE-2026-19654 is an out-of-bounds read (CWE-125) in rsyslog's imptcp input module that triggers only when the non-default framing.delimiter.regex option is active. A remote, unauthenticated attacker can send a crafted byte sequence that, during oversize-frame recovery, causes the parser to compute a negative message length, crashing rsyslogd. The fix is a one-line guard (pThis->iCurrLine > 0) ensuring a regex match at buffer offset zero is never submitted as a frame. All rsyslog versions shipping the regex-framing feature in imptcp are affected; the standard imtcp module and all default imptcp framing modes (octet-counted, LF-delimited) are not vulnerable.

The vendor's HIGH / 7.5 rating is technically defensible against the abstract CVSS vector — unauthenticated, network-reachable, no interaction required, full availability impact. But it overstates real-world risk. The vulnerability only fires when an administrator has explicitly configured regex-based TCP framing, a niche option used for parsing non-standard log sources. Most enterprise rsyslog deployments never touch this knob. The impact ceiling is a process crash (typically auto-restarted by systemd) with zero confidentiality or integrity consequence. There is no path to code execution.

Why this verdict

• Niche configuration gate: The vulnerability requires framing.delimiter.regex to be enabled in imptcp — a non-default, opt-in setting. Standard octet-counted and LF-delimited framing are not affected. This alone eliminates the majority of the rsyslog installed base from the vulnerable population.
• DoS-only impact ceiling: The CVSS vector confirms C:N/I:N/A:H. There is no path to code execution, privilege escalation, or data exfiltration. The out-of-bounds read crashes the process; it does not leak memory contents remotely.
• Auto-restart limits blast radius: systemd's Restart=on-failure directive (default for rsyslog on all major distros) brings the daemon back in seconds. Sustained denial requires a continuous crash loop, which is noisy and detectable.
• Role multiplier: rsyslog is deployed on virtually every Linux host, including high-value roles like central syslog collectors and SIEM forwarders. On a central log collector configured with regex framing, a crash causes a brief logging gap — the blast radius is *temporary visibility loss*, not host compromise, domain takeover, or fleet-wide impact. Because the impact ceiling is DoS (not RCE) and the high-value-role outcome is *seconds of log loss* (not fleet compromise or identity-plane breach), the role multiplier does not trigger the HIGH floor. The component is a log daemon, not an identity provider, hypervisor, or security agent.
• No exploitation evidence: No KEV listing, no public PoC, no observed campaigns. The attack requires knowledge of the target's specific regex pattern, adding reconnaissance friction.

Why not higher?

Upgrading to HIGH would require either a broader affected population (all rsyslog TCP listeners, not just regex-framed ones), a path to code execution or information disclosure, or evidence of active exploitation. None of these conditions are met. The regex-framing prerequisite is a hard gate that eliminates the vast majority of deployments, and the impact ceiling is a self-healing process crash.

Why not lower?

Dropping to LOW would understate the risk for the small population that *does* use regex-framed imptcp listeners. For those deployments, the crash is trivially reachable (unauthenticated, low complexity) and could be weaponized to suppress logging during an active intrusion — a meaningful operational impact. The network-reachable, no-auth attack vector keeps this above LOW.

1. Switch affected listeners from regex framing to octet-counted or LF framing — If the log source supports standard syslog framing, reconfigure the imptcp input to use the default framing mode. This completely eliminates the vulnerability without patching. Evaluate and deploy within the noisgate 365-day remediation window, or sooner if feasible.
2. Restrict imptcp listener access via firewall ACLs — Limit inbound TCP connections to the syslog port to known, trusted forwarder IPs only. This blocks unauthenticated attacker access to the vulnerable parser. No mitigation SLA applies at MEDIUM severity, but this is good hygiene to implement regardless.
3. Enable TLS mutual authentication on imptcp listeners — Configure StreamDriver=gtls with StreamDriverAuthMode=x509/name to require client certificates. This prevents unauthenticated peers from reaching the vulnerable code path.
4. Ensure systemd restart policy is active — Verify Restart=on-failure and RestartSec=5 (or lower) in the rsyslog systemd unit. This limits the window of log loss per crash to seconds. Most distro defaults already include this.
5. Deploy SIEM heartbeat / gap detection — Configure your log collector to send periodic heartbeat messages and alert when gaps exceed a threshold (e.g., 30 seconds). This detects sustained crash-loop attacks targeting rsyslog availability.

Run this script on each host running rsyslog as any user with read access to rsyslog config files (typically root). Invoke with: sudo bash check_cve_2026_19654.sh. It checks whether any imptcp input uses regex-based framing and reports VULNERABLE, PATCHED (if the installed version includes the fix), or NOT AFFECTED.

#!/usr/bin/env bash
# check_cve_2026_19654.sh — Detect CVE-2026-19654 exposure
# Checks for imptcp inputs using framing.delimiter.regex
# Exit codes: 0=PATCHED/NOT_AFFECTED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

RSYSLOG_CONF_DIRS=("/etc/rsyslog.conf" "/etc/rsyslog.d/")
VULN_PATTERN='framing\.delimiter\.regex'
REGEX_FOUND=0

# Step 1: Check if imptcp with regex framing is configured
for target in "${RSYSLOG_CONF_DIRS[@]}"; do
  if [ -e "$target" ]; then
    if grep -r -l "$VULN_PATTERN" "$target" 2>/dev/null; then
      REGEX_FOUND=1
      echo "[!] Regex framing detected in: $(grep -r -l "$VULN_PATTERN" "$target" 2>/dev/null)"
    fi
  fi
done

if [ "$REGEX_FOUND" -eq 0 ]; then
  echo "NOT AFFECTED — no imptcp input uses framing.delimiter.regex"
  exit 0
fi

# Step 2: Check installed rsyslog version for the fix
if command -v rsyslogd &>/dev/null; then
  VERSION=$(rsyslogd -v 2>/dev/null | head -1 | grep -oP '[0-9]+\.[0-9]+\.[0-9]+')
  echo "[*] Installed rsyslog version: $VERSION"
else
  echo "UNKNOWN — rsyslogd binary not found"
  exit 2
fi

# Step 3: Check if the patched source is present (look for the guard in the binary or dpkg/rpm changelog)
PATCHED=0
if command -v dpkg &>/dev/null; then
  CHANGELOG=$(dpkg -s rsyslog 2>/dev/null | grep -i 'version' | head -1 || true)
  # Check if the package has the CVE fix applied
  if dpkg --compare-versions "$(dpkg-query -W -f='${Version}' rsyslog 2>/dev/null)" ge "8.2406.0-1" 2>/dev/null; then
    PATCHED=1
  fi
  # Also check for USN/backport markers
  if apt changelog rsyslog 2>/dev/null | head -20 | grep -qi 'CVE-2026-19654'; then
    PATCHED=1
  fi
elif command -v rpm &>/dev/null; then
  if rpm -q --changelog rsyslog 2>/dev/null | head -30 | grep -qi 'CVE-2026-19654'; then
    PATCHED=1
  fi
fi

if [ "$PATCHED" -eq 1 ]; then
  echo "PATCHED — rsyslog package includes fix for CVE-2026-19654"
  exit 0
else
  echo "VULNERABLE — regex framing is enabled and no patch detected"
  echo "  Action: patch rsyslog or switch to non-regex framing mode"
  exit 1
fi

Sources

1. THREATINT CVE-2026-19654 Detail
2. rsyslog fix commit — imptcp regex framing guard
3. rsyslog merge PR #7410 — regex framing fix
4. Ubuntu USN-8598-1 rsyslog advisory
5. rsyslog imptcp framing.delimiter.regex documentation
6. LinuxSecurity — Ubuntu rsyslog advisory
7. rsyslog GitHub Security Advisories