CVE-2026-55556

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55556
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55556.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55556
Aliases
  • GHSA-947w-69ph-mc2r
Downstream
Published
2026-09-18T16:53:29Z
Modified
2026-09-26T08:12:57Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Rsyslog: Heap buffer overflow in imhttp plugin Basic Authentication handling
Details

Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parse_auth_header function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc(0, len) when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes that pointer to apr_base64_decode. An unauthenticated remote attacker can send an oversized encoded credential to an imhttp endpoint configured for Basic Authentication, causing decoded data to overwrite adjacent heap memory before credential validation. Deployments that do not install, load, and use imhttp with Basic Authentication are not affected. The demonstrated impact is a process crash that interrupts log collection, and code execution has not been demonstrated. This issue is fixed in version 8.2604.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-122"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55556.json"
}
References

Affected packages

Git / github.com/rsyslog/rsyslog

Affected ranges

Type
GIT
Repo
https://github.com/rsyslog/rsyslog
Events
Introduced
9d0aac91ecfe58fce3017c7b9121405b23e3ad5b
Fixed
acde2ba25ea33816694b787859f4a727a247b6d6
Fixed
1923792bb3e49e9997dc148c6935acbb7f3d949e
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "8.2110.0"
        },
        {
            "fixed":  "8.2604.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

Other
after_big_style_change-2025
pre-ai-agent-doc-changes-end_of_2025
rger-test1
v8.*
v8.2110.0
v8.2112.0
v8.2204.0
v8.2206.0
v8.2210.0
v8.2212.0
v8.2302.0
v8.2304.0
v8.2306.0
v8.2308.0
v8.2310.0
v8.2312.0
v8.2402.0
v8.2404.0
v8.2406.0
v8.2408.0
v8.2410.0
v8.2506.0
v8.2512.0
v8.2602.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55556.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "228172678779788366459378088291272113069",
            "length":  694
        },
        "id":  "CVE-2026-55556-22ec0fcc",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/rsyslog/rsyslog/commit/acde2ba25ea33816694b787859f4a727a247b6d6",
        "target":  {
            "file":  "contrib/imhttp/imhttp.c",
            "function":  "read_auth_file"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "257818698681726039024860984747160177335",
            "length":  774
        },
        "id":  "CVE-2026-55556-4a7bdc90",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/rsyslog/rsyslog/commit/acde2ba25ea33816694b787859f4a727a247b6d6",
        "target":  {
            "file":  "contrib/imhttp/imhttp.c",
            "function":  "parse_auth_header"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "129530035944494331656186483798269363260",
                "213765889006717086102322650980876687414",
                "221887583700192184939201060519728749194",
                "90880758438914045266952776223992342449",
                "246402827062252021574997565456273254292",
                "127483103500293302332430021246736323031",
                "325242946341057215955363005067300799767",
                "220362158977267249862137713741543561585",
                "309587190880681293139083326790668974742",
                "284313801879086122430209046366665814287",
                "277226119449738071773217748258852272803",
                "142904709644245925165599526825428261917",
                "148420930525312264886121882651168753265",
                "276568675296740305283289752171426890038",
                "292005154053540612459679861147989792841",
                "14643460365745701199142856832847551318",
                "270361154189899483221299342038922136916",
                "23985947955103934276223210280407711451",
                "142804474856026638191116619204124805266",
                "157628372145285896138835407866112651061",
                "93537640322711003872207415805922936069",
                "157725347862071252843754716574942270207",
                "53361494013442335534961955145807616190",
                "115284527354453398500360985565107856675",
                "13820691157672193540290537899253602592",
                "110293302823311296449205646689479355468",
                "160288583993014709939873020873248169338",
                "105922636784363504624190277038880172647",
                "309019002328641970112320946037166251154",
                "198183642853375448380597555116756128734",
                "205363420061294036656057816223482712382",
                "299147105310014971097934327884597172806",
                "6451665521038248787696172597218956433",
                "58433451566485753380650089359747318870",
                "92851142279545948090870557350323276516",
                "171225643053830638972981716516351237861",
                "87895555072665372569990709438010324803",
                "196242878185562126826728047695074682037",
                "168947186976917040730184415247046058714",
                "290933466830481181573722641330284309851",
                "113905185459507717390453864519306164197",
                "95273385645805001139410412652095415232",
                "194753807761555737180176252868510360775",
                "221813490476142794241637815030179766130",
                "203048187143539813084027999229504227523",
                "174077437839580263581775472856934091945",
                "333986519645586607874856707680890164656",
                "40309751164294774125549015841302144762",
                "192166592048652560863479197661467397190",
                "122826805956135402458346295365355753038",
                "286636917924972997959085846586958350599",
                "194125618313863040260508118740294151529",
                "257767401982002838907612384450265795610",
                "84025354955022915882727746735844826132",
                "326690469261706022018406669636781088717",
                "216190518900181491673260431982168760085",
                "254410508263773790553464601098917873014",
                "46332562906482365589775655393714931306",
                "144634735133027336140568110767981383270",
                "192997893769449087605969375272553444248",
                "266199718401840863430844513396518050469",
                "147470277396920511365572833204269570325",
                "81660099936868313596700374434019354810",
                "120749788958570098465314258837304821165",
                "236033840443335933014688669796572581547",
                "60177256153387489588371112462268064242",
                "140691623043200406509839364127636785682",
                "154864946892754838573287373818540731116",
                "271233913850974950923816685089146243538",
                "314257846306384491917347389851855198590",
                "158745682209545021747770295978510623428",
                "243233674045467103626410551444056904938",
                "37812147813268465361264050114170844417",
                "253884700531438840873879593245779723574",
                "187575500179639633819790291955471616425",
                "158207389130855082161774309413358674040",
                "171219430843098567799283097809880051336",
                "24603326499573081535381549359491526943",
                "89049824571628926770715467663496717804",
                "208139388537799031077522214966267651045",
                "36695569068596072363402306424718933695",
                "166151723674310585391223357752047334914",
                "164303422733146426688805614246396620047",
                "25767387988786641908557201369627646052",
                "234429058923707699710420035450924977910",
                "163913465684745759548375764916809588541",
                "19199465697180057051451688440194792307",
                "95553167864515532351511230477618533815",
                "233613567428880672178371745585182266117",
                "114518341184932595748747183033704898669",
                "333518056331506238402016629922379956063",
                "193130445177645948753518227092937800319",
                "13749629134699816521903701446699710063",
                "142452559832161913981988735841008406464",
                "36381634075419617436279347779284998876",
                "86812746044636242164059722475572079494",
                "8416530520004504646877867775564445741",
                "237036056813642011119238361601637496532",
                "51616801608957607370393082866435155877",
                "13882430340199963644067923313500937184",
                "191097692097605450323813396977937826936",
                "3003990794108908952602853970475703382",
                "135685803559070093276285825123584146440",
                "151990742365042294460776048106558740233",
                "87383149469695410934112799814817707236",
                "181650516085284006327152379364815994575",
                "95582560649172844002946368434081736085",
                "298269899780780635289437314108389723637",
                "212971203239948930556516765340540953029",
                "295021895238570902448289610555963310560",
                "127015024496732064146703045029239601711",
                "266776553189059749294082739543145672595",
                "86060093434385591653163618034080007158",
                "312391693114321006710156666166959487241",
                "198805960301412180258378958366124185963",
                "27694685480406238083210331701551818717",
                "178584028057366139082585788651991378203",
                "130609332684347571100388343538283238419",
                "22594586956602298768691205175997073932",
                "129597229262517558283172335927697811996",
                "258023919294586633132866225436707008778",
                "88509824607669235279007520396878959487",
                "111422855054991034650035985692525823540",
                "239922230581233893512345661636813370739",
                "96997789188754808366278940069532625029",
                "107661862476231474181331933462121441895",
                "246555573642925929812685961787413542858",
                "15204037928237335639001069463432754383",
                "332502351932696796035716390329465933296",
                "98261019762723229097727525371555763816",
                "178942142547861309318412395765707039638",
                "274998712875086320951713087342469688741",
                "240439209101971654217323821649126404351",
                "155237425913225283271703694160412603065",
                "138690222416314853044201747657762788305",
                "40421482359936155722660763110525540126",
                "36579333872463250128711691523633214167",
                "225363588645000123256207161381460821073",
                "136725422990009851906638897399570309773",
                "280390065114436507201307235800752139841",
                "923333021955170027390545916971560751",
                "47010840074679498380293613810944387186",
                "324039246154272663784081081505736855815",
                "13856052605160851938836058881452620827",
                "159915664726704082778908027478684033378",
                "329188752952158984633291541577525995588",
                "214099110034462251060123687991664977748",
                "230043188289526747427020297774264656051",
                "127390410637640571999323172698677787494",
                "232182039576077241513703899392922485231",
                "266435367235782527344176176214179860301",
                "173695994504350986901309297161356128498",
                "295948892361661323390541926192270257472",
                "51071747215029361083485074174461902335",
                "97046908913963843775053131115557683865",
                "36408783522513414119918220795497534024",
                "300561921229477737928144544006188792312",
                "309992463991560355628738033690244126446",
                "322683156332023576466136577714792912991",
                "117373380813603882831348389224799817702",
                "165167388731753476770136477165699357634",
                "112281529715268081195605239011429852475",
                "254891263647857995591501026203563673803",
                "69953244073217865194139172138681126738",
                "339025449917794367496378800566212603077",
                "112353985770226597717836046038480580624",
                "127304106874678749883856687705471787956",
                "7812549827684716652326069139807514542",
                "194541084175484236855238182776287267106",
                "57206709820254464102451722579864821687",
                "15869633709284234556921630563086664127",
                "203975530377231306345957293491325948227",
                "191881770011739002945442296419288445308",
                "151990742365042294460776048106558740233",
                "48740448955830581354083069748015365572",
                "314416072988591275644518612437323520785",
                "116236367786461974976479323558514868343",
                "99205118087389095968414079582677410567",
                "91596675118169771483561649644548688455",
                "163063670613674612400190832304262278143",
                "84340873276732794353053132651401186248",
                "105452321160705499210121928752193094819",
                "253613672395217774257085060944916902324",
                "301909808476456619525819190427850783927",
                "157107108246473029453908609627409766485",
                "161732749149567801983547904031069350087",
                "174645286738563170306702889430606759132",
                "233942225500967067032365778902443797375",
                "109846291202453681778588567905125136764",
                "119331698362479654809482743147018859601",
                "134198291351131298738622839198675401757",
                "261129503879392252305080964837290306848",
                "58961130799234123155424323470996313491",
                "183440288253039073404219689200650777964",
                "68694956617490393942753457187975615975",
                "247441708873567254098103999216402701935",
                "85467289399412216318930438697737923410",
                "92330652513404485907606519265762225258",
                "175369567902318781475541564239276440890",
                "79904153684300847458949065494528937462",
                "168624762683106882482952419406284758174",
                "171097392140153523458650644915041214063",
                "299055155997282285109158882136416923883",
                "268339513883869699385821715320890365287",
                "276302993752582035305126654038782658527",
                "262406340452259682434349176633080002977",
                "110622457220317105826076800502018530389",
                "39405639211785637264405360817212948073",
                "59315143307782615842071110286993342472",
                "43651918072412438858749158123410655308",
                "234503127921218967419288937745041817780",
                "97287372765465585688631680909887376827",
                "187973524007890569717458700135105518593",
                "280256286654825985914512979104945716694",
                "106621951949992311425625811693580937842",
                "267969134508041218394693305273085005792",
                "64759591506902998647979183089948000420",
                "151930532582651381386160516564832232686",
                "116955640003996664123599148947070470623",
                "159050481433392928955343668548218667109",
                "180807444873798599957354919530695896187",
                "145549268553293900772509831775019445967",
                "326238042971765352582719801470444834391",
                "338816875762319044368943726611956040214",
                "89627747143457892158850031719500277554"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-55556-4dbfc259",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/rsyslog/rsyslog/commit/acde2ba25ea33816694b787859f4a727a247b6d6",
        "target":  {
            "file":  "contrib/imhttp/imhttp.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "55132648018840156880391771206240132088",
            "length":  756
        },
        "id":  "CVE-2026-55556-5243af5f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/rsyslog/rsyslog/commit/acde2ba25ea33816694b787859f4a727a247b6d6",
        "target":  {
            "file":  "contrib/imhttp/imhttp.c",
            "function":  "createInstance"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "313282285036993156861652291832716267843",
            "length":  283
        },
        "id":  "CVE-2026-55556-5dad2d83",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/rsyslog/rsyslog/commit/acde2ba25ea33816694b787859f4a727a247b6d6",
        "target":  {
            "file":  "contrib/imhttp/imhttp.c",
            "function":  "authorize"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "252657083520156397020594841243563872542",
            "length":  1615
        },
        "id":  "CVE-2026-55556-844a082c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/rsyslog/rsyslog/commit/acde2ba25ea33816694b787859f4a727a247b6d6",
        "target":  {
            "file":  "contrib/imhttp/imhttp.c",
            "function":  "runloop"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "97707536392067334405218836841805722149",
            "length":  2499
        },
        "id":  "CVE-2026-55556-b1fdc017",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/rsyslog/rsyslog/commit/acde2ba25ea33816694b787859f4a727a247b6d6",
        "target":  {
            "file":  "contrib/imhttp/imhttp.c",
            "function":  "postHandler"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "800913306369237132684640581515755778",
            "length":  802
        },
        "id":  "CVE-2026-55556-f812338a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/rsyslog/rsyslog/commit/acde2ba25ea33816694b787859f4a727a247b6d6",
        "target":  {
            "file":  "contrib/imhttp/imhttp.c",
            "function":  "basicAuthHandler"
        }
    }
]
vanir_signatures_modified 
"2026-09-26T08:12:57Z"