CVE-2026-39879

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-39879
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39879.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-39879
Aliases
  • GHSA-qwf9-6222-m24m
Downstream
Published
2026-07-20T16:57:32.019Z
Modified
2026-07-23T03:56:30.215485507Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CVSS Calculator
Summary
SQL injection in syslog-ng SQL destionation driver
Details

Due to a missing sanitization call in afsql_dd_run_query, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured.

Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and syslog-ng Store Box 7.8

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39879.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-150"
    ]
}
References

Affected packages

Git / github.com/syslog-ng/syslog-ng

Affected ranges

Type
GIT
Repo
https://github.com/syslog-ng/syslog-ng
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1a0e59077f5b709fa499e18b12e4462551396215
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.12"
        }
    ]
}

Affected versions

pe-5.*
pe-5.0-base
syslog-ng-3.*
syslog-ng-3.10.1
syslog-ng-3.11.1
syslog-ng-3.12.1
syslog-ng-3.13.1
syslog-ng-3.13.2
syslog-ng-3.14.1
syslog-ng-3.15.1
syslog-ng-3.16.1
syslog-ng-3.17.1
syslog-ng-3.17.2
syslog-ng-3.18.1
syslog-ng-3.19.1
syslog-ng-3.20.1
syslog-ng-3.21.1
syslog-ng-3.22.1
syslog-ng-3.23.1
syslog-ng-3.24.1
syslog-ng-3.25.1
syslog-ng-3.26.1
syslog-ng-3.27.1
syslog-ng-3.28.1
syslog-ng-3.29.1
syslog-ng-3.30.1
syslog-ng-3.31.1
syslog-ng-3.31.2
syslog-ng-3.32.1
syslog-ng-3.33.1
syslog-ng-3.33.2
syslog-ng-3.34.1
syslog-ng-3.35.1
syslog-ng-3.36.1
syslog-ng-3.37.1
syslog-ng-3.38.1
syslog-ng-3.6.0alpha1
syslog-ng-3.6.0alpha2
syslog-ng-3.6.0alpha3
syslog-ng-3.6.0beta1
syslog-ng-3.6.0beta2
syslog-ng-3.6.0rc1
syslog-ng-3.6.0rc2
syslog-ng-3.6.1
syslog-ng-3.7.0alpha1
syslog-ng-3.7.0alpha2
syslog-ng-3.7.0beta1
syslog-ng-3.7.0beta2
syslog-ng-3.7.1
syslog-ng-3.7.2
syslog-ng-3.8.0beta1
syslog-ng-3.8.0beta2
syslog-ng-3.8.1
syslog-ng-3.9.1
syslog-ng-4.*
syslog-ng-4.0.0
syslog-ng-4.0.1
syslog-ng-4.1.0
syslog-ng-4.1.1
syslog-ng-4.10.1
syslog-ng-4.10.2
syslog-ng-4.11.0
syslog-ng-4.2.0
syslog-ng-4.3.0
syslog-ng-4.3.1
syslog-ng-4.4.0
syslog-ng-4.5.0
syslog-ng-4.6.0
syslog-ng-4.7.0
syslog-ng-4.7.1
syslog-ng-4.8.0
syslog-ng-4.8.1
syslog-ng-4.8.2
syslog-ng-4.8.3
syslog-ng-4.9.0
v2.*
v2.1.1
v2.1alpha1
v2.1beta1
v2.1beta2
v3.*
v3.0.1
v3.0.2
v3.1.0
v3.1beta1
v3.1beta2
v3.2alpha1
v3.2beta1
v3.3.0alpha1
v3.3.0alpha2
v3.4.0alpha1
v3.4.0alpha2
v3.4.0alpha3
v3.4.0beta1
v3.4.0rc1
v3.4.0rc2
v3.5.0_rc1
v3.5.0beta1
v3.5.0beta2
v3.5.0beta3
v3.5.0rc1
v3.5.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39879.json"