A flaw was found in rsyslog.

CVE-2026-78002 is a heap buffer overflow in rsyslog's RainerScript replace() function. When rsyslog is configured to use replace() on incoming syslog messages — for example, to sanitize or rewrite log fields — an unauthenticated attacker who can send crafted syslog messages to the listener can trigger an incorrect buffer size calculation (CWE-131) that corrupts heap memory and crashes the rsyslog process. The impact ceiling is denial of service only: the CVSS vector explicitly scores C:N/I:N/A:H. All rsyslog versions through 8.2608.0-3 are affected; the fix landed in 8.2608.0-4 upstream, with Debian backporting to 8.2504.0-1+deb13u2 and SUSE shipping SUSE-SU-2026:3861-1 on 2026-08-28.

The vendor HIGH / 7.5 rating reflects the raw CVSS math: network-reachable, no auth, no interaction, high availability impact. That math is honest *if* rsyslog is listening on a network socket *and* the config uses replace() on attacker-controlled input. In practice, most enterprise rsyslog deployments receive logs over the internal network — not the internet — and a meaningful fraction never use the replace() function at all. Combined with the DoS-only impact (no code execution, no data leak) and the fact that systemd will auto-restart the crashed process, the real-world severity is closer to MEDIUM.

Why this verdict

• DoS-only impact ceiling: The CVSS vector explicitly scores C:N/I:N/A:H. There is no path to code execution, privilege escalation, or data compromise. The worst outcome is a logging interruption.
• Config-dependent code path: The replace() function must be actively used in the rsyslog config on attacker-influenced message fields. Deployments using rsyslog as a plain forwarder with template-based output are not vulnerable. This materially reduces the exposed population.
• Internal network exposure: Syslog listeners are overwhelmingly internal-only. Internet exposure of port 514 is a misconfiguration, not a default. Attackers need internal network access (post-initial-compromise) or a very unusual perimeter config to reach the listener.
• Auto-restart mitigation: systemd's Restart=on-failure directive on the rsyslog unit means the service recovers in seconds after each crash. Sustained DoS requires continuous attack traffic, which is noisy and detectable.
• Role multiplier: rsyslog occupies the SIEM / detection plane role — it is the log transport layer. On a central syslog collector or SIEM forwarder, a sustained crash creates a detection blind spot that an attacker could exploit to mask concurrent activity. This is the highest-value scenario. However, the impact is still DoS (temporary log loss), not compromise of the collector itself. The blind-spot risk prevents a LOW rating but does not reach HIGH because (a) the attacker gains no persistent foothold, (b) systemd auto-restart limits the window, and (c) the replace() config prerequisite narrows which collectors are actually vulnerable.

Why not higher?

To justify HIGH, the vulnerability would need to enable code execution, persistent compromise, or reliable fleet-wide impact. This bug achieves none of those: it is a crash-only DoS that requires a specific RainerScript configuration and only affects availability. The absence of any public PoC, KEV listing, or in-the-wild exploitation further undermines the case for HIGH. While the detection-plane role of rsyslog is important, the transient nature of the DoS (auto-restart) and the config prerequisite keep the real-world risk below the HIGH threshold.

Why not lower?

rsyslog is installed on virtually every Linux server in an enterprise fleet, making the *potential* population enormous even if the *actually vulnerable* subset (those using replace()) is smaller. The detection-plane role means a crash creates a security-relevant blind spot, not just a benign service interruption. The network-reachable, no-auth, no-interaction attack vector is genuinely easy to execute once the attacker has internal access and the config prerequisite is met. These factors keep the rating at MEDIUM rather than LOW.

1. Audit rsyslog configs for replace() usage — Run grep -rn 'replace(' /etc/rsyslog.conf /etc/rsyslog.d/ on all hosts. If replace() is not used, you are not vulnerable and can deprioritize patching. This takes minutes and immediately scopes the risk. No mitigation SLA applies for MEDIUM — go straight to the 365-day remediation window.
2. Restrict syslog listener access via firewall rules — Ensure rsyslog's TCP/UDP 514 (or custom port) only accepts connections from known, trusted log sources. Use iptables/nftables or AllowedSender directives in rsyslog.conf. This prevents arbitrary internal hosts from reaching the listener.
3. Enable systemd auto-restart and watchdog — Verify the rsyslog systemd unit has Restart=on-failure and WatchdogSec= configured. This limits the DoS window to seconds per crash. Most distro-shipped units already have this.
4. Deploy the vendor patch within the 365-day remediation window — Apply rsyslog 8.2608.0-4 (upstream) or distro-specific updates (Debian 8.2504.0-1+deb13u2, SUSE-SU-2026:3861-1, USN-8598-1). Per noisgate remediation SLA for MEDIUM, patch within 365 days.

Run this script on each target Linux host where rsyslog is installed. Execute as any user with read access to rsyslog config and the rsyslog binary (typically root or via sudo). Example: sudo bash check_cve_2026_78002.sh

#!/bin/bash
# check_cve_2026_78002.sh
# Checks whether the host is vulnerable to CVE-2026-78002
# (rsyslog RainerScript replace() heap buffer overflow)
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

RSYSLOG_BIN=$(command -v rsyslogd 2>/dev/null || true)

if [ -z "$RSYSLOG_BIN" ]; then
  echo "UNKNOWN: rsyslogd not found on this host."
  exit 2
fi

VERSION=$($RSYSLOG_BIN -v 2>/dev/null | head -1 | grep -oP '[0-9]+\.[0-9]+\.[0-9]+')

if [ -z "$VERSION" ]; then
  echo "UNKNOWN: Could not determine rsyslog version."
  exit 2
fi

echo "Detected rsyslog version: $VERSION"

# Check for replace() usage in config
REPLACE_USED=$(grep -rl 'replace(' /etc/rsyslog.conf /etc/rsyslog.d/ 2>/dev/null || true)

if [ -z "$REPLACE_USED" ]; then
  echo "NOTE: replace() function not found in rsyslog config. Vulnerable code path is not reachable."
else
  echo "WARNING: replace() function found in: $REPLACE_USED"
fi

# Compare version - fixed in 8.2608.0-4 upstream
# For Debian, fixed in 8.2504.0-1+deb13u2
# We check the base version; distro backports may differ
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

# Check distro-specific package version for more accuracy
PKG_VER=""
if command -v dpkg-query &>/dev/null; then
  PKG_VER=$(dpkg-query -W -f='${Version}' rsyslog 2>/dev/null || true)
  echo "Debian/Ubuntu package version: $PKG_VER"
  if echo "$PKG_VER" | grep -qP 'deb13u[2-9]'; then
    echo "PATCHED: Debian package includes the fix ($PKG_VER)."
    exit 0
  fi
elif command -v rpm &>/dev/null; then
  PKG_VER=$(rpm -q rsyslog 2>/dev/null || true)
  echo "RPM package version: $PKG_VER"
fi

# Upstream version check
if [ "$MAJOR" -gt 8 ]; then
  echo "PATCHED: rsyslog version $VERSION is above affected range."
  exit 0
elif [ "$MAJOR" -eq 8 ] && [ "$MINOR" -gt 2608 ]; then
  echo "PATCHED: rsyslog version $VERSION is above affected range."
  exit 0
elif [ "$MAJOR" -eq 8 ] && [ "$MINOR" -eq 2608 ] && [ "$PATCH" -ge 4 ]; then
  echo "PATCHED: rsyslog version $VERSION includes the fix."
  exit 0
else
  echo "VULNERABLE: rsyslog version $VERSION is in the affected range (< 8.2608.0-4)."
  if [ -z "$REPLACE_USED" ]; then
    echo "MITIGATED: However, replace() is not used in config — code path is not reachable."
  fi
  exit 1
fi

Sources

1. Debian Bug #1145980 (closed)
2. Debian changelog for rsyslog 8.2504.0-1+deb13u2
3. SUSE Security Update SUSE-SU-2026:3861-1
4. Ubuntu USN-8598-1
5. rsyslog Security Advisories
6. CVE Details - rsyslog vulnerabilities
7. GHSA for rsyslog heap overflow (prior similar vuln)