CVE-2026-19654

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-19654
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19654.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-19654
Aliases
  • GHSA-cj5r-wh2m-7w29
Downstream
Published
2026-08-12T20:46:31.853Z
Modified
2026-08-28T03:30:54.892525289Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd
Details

A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19654.json",
    "cwe_ids": [
        "CWE-125"
    ],
    "cna_assigner": "redhat"
}
References

Affected packages

Git / github.com/rsyslog/rsyslog

Affected ranges

Type
GIT
Repo
https://github.com/rsyslog/rsyslog
Events
Introduced
1d7e3af5d725c3d47c3192a558e89a3be11e79c1
Fixed
4bac899196d597c732f59bbcfe8ac9da40d60769
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:rsyslog:rsyslog:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "8.36.0"
        },
        {
            "fixed": "8.2608.0"
        }
    ]
}

Affected versions

Other
after_big_style_change-2025
pre-ai-agent-doc-changes-end_of_2025
rger-test1
v8.*
v8.1901.0
v8.1905.0
v8.1907.0
v8.1908.0
v8.1910.0
v8.1911.0
v8.2001.0
v8.2002.0
v8.2004.0
v8.2006.0
v8.2008.0
v8.2010.0
v8.2012.0
v8.2102.0
v8.2104.0
v8.2106.0
v8.2108.0
v8.2110.0
v8.2112.0
v8.2204.0
v8.2206.0
v8.2210.0
v8.2212.0
v8.2302.0
v8.2304.0
v8.2306.0
v8.2308.0
v8.2310.0
v8.2312.0
v8.2402.0
v8.2404.0
v8.2406.0
v8.2408.0
v8.2410.0
v8.2506.0
v8.2512.0
v8.2602.0
v8.2604.0
v8.2606.0
v8.36.0
v8.37.0
v8.38.0
v8.39.0
v8.40.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19654.json"