CVE-2026-55556

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55556
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55556.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55556
Aliases
  • GHSA-947w-69ph-mc2r
Downstream
Published
2026-09-18T16:53:29Z
Modified
2026-09-19T03:46:35Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Rsyslog: Heap buffer overflow in imhttp plugin Basic Authentication handling
Details

Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parse_auth_header function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc(0, len) when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes that pointer to apr_base64_decode. An unauthenticated remote attacker can send an oversized encoded credential to an imhttp endpoint configured for Basic Authentication, causing decoded data to overwrite adjacent heap memory before credential validation. Deployments that do not install, load, and use imhttp with Basic Authentication are not affected. The demonstrated impact is a process crash that interrupts log collection, and code execution has not been demonstrated. This issue is fixed in version 8.2604.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-122"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55556.json"
}
References

Affected packages

Git / github.com/rsyslog/rsyslog

Affected ranges

Type
GIT
Repo
https://github.com/rsyslog/rsyslog
Events
Introduced
9d0aac91ecfe58fce3017c7b9121405b23e3ad5b
Fixed
1923792bb3e49e9997dc148c6935acbb7f3d949e
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "8.2110.0"
        },
        {
            "fixed": "8.2604.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

Other
after_big_style_change-2025
pre-ai-agent-doc-changes-end_of_2025
rger-test1
v8.*
v8.2110.0
v8.2112.0
v8.2204.0
v8.2206.0
v8.2210.0
v8.2212.0
v8.2302.0
v8.2304.0
v8.2306.0
v8.2308.0
v8.2310.0
v8.2312.0
v8.2402.0
v8.2404.0
v8.2406.0
v8.2408.0
v8.2410.0
v8.2506.0
v8.2512.0
v8.2602.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55556.json"