CVE-2026-55841

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-55841

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55841.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-55841

Aliases

GHSA-gqr6-r77p-c2pj

Published

2026-08-28T22:11:08.747Z

Modified

2026-08-30T08:17:18.524785Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message

Details

Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java and graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java mishandles field-like text inside quoted values. GLFortiGateSyslogEvent.getFields() uses KVPATTERN and QUOTEDKV_PATTERN, while SyslogCodec.parse() invokes the FortiGateSyslogEvent parser; crafted values containing = or backslash-escaped quotes can cause embedded keys such as srcip, dstip, date, time, and tz to remove or overwrite original top-level fields or produce an invalid message that Graylog discards. An unauthenticated network sender who can submit syslog messages can therefore manipulate security-log fields or evade logging to obscure malicious activity. This issue is fixed in Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55841.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-138"
    ]
}

References

Affected packages

Git / github.com/graylog2/graylog2-server

Affected ranges

Type

GIT

Repo

https://github.com/graylog2/graylog2-server

Events

Introduced

dac42698ecd7e1be0652802e6308c55b0fc5cdca

Introduced

a9355313df2c2106f48684eb47617980ab4d42db

Fixed

fd62097b3ac4d3f18641e973e4823ed9bf663122

Fixed

5cd524ef532ecf6c77fe5efebcd0d2a5143f893c

Fixed

adc626831f3170716845df46ae9237b7e93e1d7d

Fixed

793df6e8202ea55c15a762e47a2a8a775961dd3f

Fixed

85dc699d6319aea433583dc239077a3a799c8627

Fixed

d5051e604c962ef3d4e5e8e434d0ff4907d2140d

Fixed

dde76d7432c469887d9a95c208083c5f0f73c70d

Database specific

Show details

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.3.12"
        },
        {
            "introduced": "7.0.0-alpha.1"
        },
        {
            "fixed": "7.0.7"
        },
        {
            "introduced": "7.1.0-alpha.1"
        },
        {
            "fixed": "7.1.2"
        }
    ]
}

Affected versions

0.*

0.10.0

0.10.0-preview.2

0.10.0-rc.1

0.10.0-rc.2

0.10.0-rc.3

0.10.0-rc.4

0.11.0

0.20.0-preview.1

0.20.0-preview.2

0.20.0-preview.3

0.20.0-preview.4

0.20.0-preview.5

0.20.0-preview.6

0.20.0-rc.1

0.20.0-rc.1-1

0.21.0-beta1

0.21.0-beta2

0.21.0-beta3

0.21.0-beta4

0.21.0-rc.1

0.9

0.9.1

0.9.2

0.9.3

0.9.4

0.9.4p1

0.9.5

0.9.5p1

0.9.6

0.9.6-PREVIEW

0.9.6-PREVIEW.2

0.9.6-PREVIEW.3

0.9.6-beta

0.9.7-preview.1

1.*

1.0.0-beta.1

1.1.0-beta.1

1.1.0-beta.2

1.1.0-beta.3

1.1.0-rc.1

1.2.0-rc.1

1.2.0-rc.2

1.2.0-rc.3

1.2.0-rc.4

2.*

2.0.0-alpha.1

2.0.0-alpha.2

2.0.0-alpha.3

2.0.0-alpha.4

2.0.0-alpha.5

2.0.0-beta.1

2.0.0-beta.2

2.0.0-beta.3

2.1.0-alpha.1

2.1.0-alpha.2

2.1.0-beta.1

2.1.0-beta.2

2.1.0-beta.3

2.1.0-beta.4

2.1.0-rc.1

2.2.0

2.2.0-alpha.1

2.2.0-alpha.2

2.2.0-alpha.3

2.2.0-alpha.4

2.2.0-beta.1

2.2.0-beta.2

2.2.0-beta.3

2.2.0-beta.4

2.2.0-beta.5

2.2.0-beta.6

2.2.0-rc.1

2.3.0-alpha.1

2.3.0-alpha.2

2.3.0-alpha.3

2.3.0-beta.1

2.3.0-rc.1

2.4.0-alpha.1

2.4.0-alpha.2

2.4.0-alpha.3

3.*

3.0.0-alpha.0

3.0.0-alpha.1

3.0.0-alpha.2

3.0.0-alpha.3

3.0.0-alpha.4

3.0.0-alpha.5

3.0.0-beta.1

3.1.0

3.1.0-beta.1

3.1.0-beta.2

3.1.0-beta.3

3.1.0-rc.1

3.1.0-rc.2

3.2.0-beta.1

3.2.0-beta.2

3.2.0-beta.3

3.2.0-beta.4

3.2.0-rc.1

3.3.0-beta.1

3.3.0-beta.2

3.3.0-beta.3

3.3.0-rc.1

4.*

4.0.0-beta.1

4.0.0-beta.2

4.0.0-beta.3

4.0.0-beta.4

4.0.0-rc.1

4.1.0

4.1.0-beta.1

4.1.0-beta.2

4.1.0-rc.1

4.2.0-beta.1

4.3.0-beta.1

4.3.0-beta.2

4.3.0-beta.3

4.3.0-rc.1

5.*

5.0.0-alpha.1

5.0.0-beta.1

5.0.0-beta.2

5.0.0-beta.3

5.0.0-beta.4

5.0.0-beta.5

5.0.0-rc.1

5.1.0-beta.1

5.1.0-beta.2

5.1.0-beta.3

5.1.0-rc.1

5.2.0-alpha.1

5.2.0-beta.1

5.2.0-beta.2

5.2.0-beta.3

5.2.0-rc.1

6.*

6.0.0-alpha.1

6.0.0-alpha.2

6.0.0-alpha.3

6.0.0-beta.1

6.0.0-beta.2

6.0.0-beta.3

6.0.0-beta.4

6.0.0-beta.5

6.0.0-rc.1

6.1.0-alpha.1

6.1.0-alpha.2

6.1.0-alpha.3

6.1.0-alpha.4

6.1.0-alpha.5

6.1.0-alpha.6

6.1.0-alpha.7

6.1.0-alpha.8

6.1.0-beta.1

6.1.0-beta.2

6.1.0-beta.3

6.1.0-beta.4

6.1.0-rc.1

6.2.0-alpha.1

6.2.0-alpha.2

6.2.0-beta.1

6.2.0-beta.2

6.2.0-beta.3

6.2.0-beta.4

6.2.0-rc.1

6.3.0

6.3.0-alpha.1

6.3.0-alpha.2

6.3.0-alpha.3

6.3.0-alpha.4

6.3.0-beta.1

6.3.0-beta.2

6.3.0-beta.3

6.3.0-beta.4

6.3.0-beta.5

6.3.0-rc.1

6.3.0-rc.2

6.3.1

6.3.10

6.3.11

6.3.2

6.3.3

6.3.4

6.3.5

6.3.6

6.3.7

6.3.8

6.3.9

7.*

7.0.0

7.0.0-alpha.1

7.0.0-alpha.2

7.0.0-beta.1

7.0.0-beta.2

7.0.0-beta.3

7.0.0-beta.4

7.0.0-beta.5

7.0.0-rc.1

7.0.0-rc.2

7.0.1

7.0.2

7.0.3

7.0.4

7.0.5

7.0.6

7.1.0

7.1.0-alpha.1

7.1.0-alpha.2

7.1.0-alpha.3

7.1.0-beta.1

7.1.0-beta.2

7.1.0-rc.1

7.1.0-rc.2

7.1.1

v0.*

v0.20.0-preview.1

v0.20.0-rc.1-1

Database specific

vanir_signatures

[
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "15362446443876422941302116121430697273",
                "87363060031788600291146251482431208907",
                "142563972264437719276925212889253680517",
                "279641879984668709823898754400064265155",
                "59631639438567229310350670061053344940",
                "294995614133824592350078025824309437690",
                "4169884190394616061853945079528622428",
                "296157472858476058314775659311726157960",
                "309706790420547297554883015137944032163",
                "325561064640539043766225136483341798948",
                "131422881970629110722005493850014154854",
                "180193110781738444384922475959849293281",
                "179505420130240855232519323926324128580",
                "82857527865893591583358080384239562916",
                "259467936089202316878613877197598759908",
                "249486976892969964465605102581367974488",
                "197582608243576381800270104275372599088",
                "144931851415440112903114155728419047678",
                "3972145865375821819176435214827962918",
                "141181810583293165749102648986995716309",
                "196648260424735418313989979597310267065",
                "163745351664781463700151443176822741118",
                "52002965412930771717325984340023745694",
                "263363652826078568824819868002265078445",
                "269824758218695936869505536230757116443",
                "98174471838803670294902720184648527244",
                "58055859803695640475990503145022486318",
                "180111087316262008212385216071056988976",
                "164279810374869493711692214849343187021",
                "187907437099871657069614725870404597808",
                "110324764065556357123831084359114594453",
                "12689079880980314770530599917810251631",
                "302610303621857111509314079126959667057"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55841-04ec47d9",
        "target": {
            "file": "graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java"
        },
        "source": "https://github.com/graylog2/graylog2-server/commit/dde76d7432c469887d9a95c208083c5f0f73c70d",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 68.0,
            "function_hash": "329843847068552324655743178063563805308"
        },
        "id": "CVE-2026-55841-0e6d5aa6",
        "target": {
            "function": "GLFortiGateSyslogEvent",
            "file": "graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java"
        },
        "source": "https://github.com/graylog2/graylog2-server/commit/dde76d7432c469887d9a95c208083c5f0f73c70d",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "104599310443839456948951619663259869130",
                "47694366066253477461081445870832984492",
                "315400544180267323138870657385856486546",
                "223984200929579114318453227088878249701",
                "280524511235448493085252442217958163117",
                "130613388634643825772252876001576432771",
                "1740651935478791410299279390482502125",
                "212032248164427625133915601252929713940",
                "161622807411533134244444557897651141284",
                "24549162730389765243366254185434072577",
                "87824252477587183429121953135565411795",
                "12963804225298521908397641710967828696",
                "329564048774202197813264483685327432201"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55841-27f5a363",
        "target": {
            "file": "graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java"
        },
        "source": "https://github.com/graylog2/graylog2-server/commit/793df6e8202ea55c15a762e47a2a8a775961dd3f",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 557.0,
            "function_hash": "86086632338616361761655710191277153799"
        },
        "id": "CVE-2026-55841-2f9aa218",
        "target": {
            "function": "getFields",
            "file": "graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java"
        },
        "source": "https://github.com/graylog2/graylog2-server/commit/dde76d7432c469887d9a95c208083c5f0f73c70d",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "308869814200975557154812010259433697522",
                "73887472117018902670438594284674070072",
                "163713028992810329145584129981731837494"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55841-302c2008",
        "target": {
            "file": "graylog2-server/src/test/java/org/graylog2/inputs/codecs/SyslogCodecTest.java"
        },
        "source": "https://github.com/graylog2/graylog2-server/commit/793df6e8202ea55c15a762e47a2a8a775961dd3f",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "89434528082666317534464821002429643359",
                "275599133969428259503054527328334980489",
                "163713028992810329145584129981731837494"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55841-4f8ffe18",
        "target": {
            "file": "graylog2-server/src/test/java/org/graylog2/inputs/codecs/SyslogCodecTest.java"
        },
        "source": "https://github.com/graylog2/graylog2-server/commit/d5051e604c962ef3d4e5e8e434d0ff4907d2140d",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 557.0,
            "function_hash": "86086632338616361761655710191277153799"
        },
        "id": "CVE-2026-55841-4fdb4e9f",
        "target": {
            "function": "getFields",
            "file": "graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java"
        },
        "source": "https://github.com/graylog2/graylog2-server/commit/85dc699d6319aea433583dc239077a3a799c8627",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "15362446443876422941302116121430697273",
                "87363060031788600291146251482431208907",
                "142563972264437719276925212889253680517",
                "279641879984668709823898754400064265155",
                "59631639438567229310350670061053344940",
                "294995614133824592350078025824309437690",
                "4169884190394616061853945079528622428",
                "296157472858476058314775659311726157960",
                "309706790420547297554883015137944032163",
                "325561064640539043766225136483341798948",
                "131422881970629110722005493850014154854",
                "180193110781738444384922475959849293281",
                "179505420130240855232519323926324128580",
                "82857527865893591583358080384239562916",
                "259467936089202316878613877197598759908",
                "249486976892969964465605102581367974488",
                "197582608243576381800270104275372599088",
                "144931851415440112903114155728419047678",
                "3972145865375821819176435214827962918",
                "141181810583293165749102648986995716309",
                "196648260424735418313989979597310267065",
                "163745351664781463700151443176822741118",
                "52002965412930771717325984340023745694",
                "263363652826078568824819868002265078445",
                "269824758218695936869505536230757116443",
                "98174471838803670294902720184648527244",
                "58055859803695640475990503145022486318",
                "180111087316262008212385216071056988976",
                "164279810374869493711692214849343187021",
                "187907437099871657069614725870404597808",
                "110324764065556357123831084359114594453",
                "12689079880980314770530599917810251631",
                "302610303621857111509314079126959667057"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55841-5327e71b",
        "target": {
            "file": "graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java"
        },
        "source": "https://github.com/graylog2/graylog2-server/commit/85dc699d6319aea433583dc239077a3a799c8627",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "308869814200975557154812010259433697522",
                "73887472117018902670438594284674070072",
                "163713028992810329145584129981731837494"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55841-5b4ce8b6",
        "target": {
            "file": "graylog2-server/src/test/java/org/graylog2/inputs/codecs/SyslogCodecTest.java"
        },
        "source": "https://github.com/graylog2/graylog2-server/commit/85dc699d6319aea433583dc239077a3a799c8627",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 68.0,
            "function_hash": "329843847068552324655743178063563805308"
        },
        "id": "CVE-2026-55841-5e06e2f4",
        "target": {
            "function": "GLFortiGateSyslogEvent",
            "file": "graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java"
        },
        "source": "https://github.com/graylog2/graylog2-server/commit/85dc699d6319aea433583dc239077a3a799c8627",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "308869814200975557154812010259433697522",
                "73887472117018902670438594284674070072",
                "163713028992810329145584129981731837494"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55841-61d03d85",
        "target": {
            "file": "graylog2-server/src/test/java/org/graylog2/inputs/codecs/SyslogCodecTest.java"
        },
        "source": "https://github.com/graylog2/graylog2-server/commit/dde76d7432c469887d9a95c208083c5f0f73c70d",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "104599310443839456948951619663259869130",
                "47694366066253477461081445870832984492",
                "315400544180267323138870657385856486546",
                "223984200929579114318453227088878249701",
                "280524511235448493085252442217958163117",
                "130613388634643825772252876001576432771",
                "1740651935478791410299279390482502125",
                "212032248164427625133915601252929713940",
                "161622807411533134244444557897651141284",
                "24549162730389765243366254185434072577",
                "87824252477587183429121953135565411795",
                "12963804225298521908397641710967828696",
                "329564048774202197813264483685327432201"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55841-8250c1ed",
        "target": {
            "file": "graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java"
        },
        "source": "https://github.com/graylog2/graylog2-server/commit/dde76d7432c469887d9a95c208083c5f0f73c70d",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 557.0,
            "function_hash": "86086632338616361761655710191277153799"
        },
        "id": "CVE-2026-55841-a0092e51",
        "target": {
            "function": "getFields",
            "file": "graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java"
        },
        "source": "https://github.com/graylog2/graylog2-server/commit/793df6e8202ea55c15a762e47a2a8a775961dd3f",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "104599310443839456948951619663259869130",
                "47694366066253477461081445870832984492",
                "315400544180267323138870657385856486546",
                "223984200929579114318453227088878249701",
                "280524511235448493085252442217958163117",
                "130613388634643825772252876001576432771",
                "1740651935478791410299279390482502125",
                "212032248164427625133915601252929713940",
                "161622807411533134244444557897651141284",
                "24549162730389765243366254185434072577",
                "87824252477587183429121953135565411795",
                "12963804225298521908397641710967828696",
                "329564048774202197813264483685327432201"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55841-bc62740e",
        "target": {
            "file": "graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java"
        },
        "source": "https://github.com/graylog2/graylog2-server/commit/85dc699d6319aea433583dc239077a3a799c8627",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 68.0,
            "function_hash": "329843847068552324655743178063563805308"
        },
        "id": "CVE-2026-55841-cfa2d8ff",
        "target": {
            "function": "GLFortiGateSyslogEvent",
            "file": "graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java"
        },
        "source": "https://github.com/graylog2/graylog2-server/commit/793df6e8202ea55c15a762e47a2a8a775961dd3f",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "15362446443876422941302116121430697273",
                "87363060031788600291146251482431208907",
                "142563972264437719276925212889253680517",
                "279641879984668709823898754400064265155",
                "59631639438567229310350670061053344940",
                "294995614133824592350078025824309437690",
                "4169884190394616061853945079528622428",
                "296157472858476058314775659311726157960",
                "309706790420547297554883015137944032163",
                "325561064640539043766225136483341798948",
                "131422881970629110722005493850014154854",
                "180193110781738444384922475959849293281",
                "179505420130240855232519323926324128580",
                "82857527865893591583358080384239562916",
                "259467936089202316878613877197598759908",
                "249486976892969964465605102581367974488",
                "197582608243576381800270104275372599088",
                "144931851415440112903114155728419047678",
                "3972145865375821819176435214827962918",
                "141181810583293165749102648986995716309",
                "196648260424735418313989979597310267065",
                "163745351664781463700151443176822741118",
                "52002965412930771717325984340023745694",
                "263363652826078568824819868002265078445",
                "269824758218695936869505536230757116443",
                "98174471838803670294902720184648527244",
                "58055859803695640475990503145022486318",
                "180111087316262008212385216071056988976",
                "164279810374869493711692214849343187021",
                "187907437099871657069614725870404597808",
                "110324764065556357123831084359114594453",
                "12689079880980314770530599917810251631",
                "302610303621857111509314079126959667057"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55841-eb9f6821",
        "target": {
            "file": "graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFortiGateSyslogEvent.java"
        },
        "source": "https://github.com/graylog2/graylog2-server/commit/793df6e8202ea55c15a762e47a2a8a775961dd3f",
        "signature_version": "v1"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55841.json"

vanir_signatures_modified

"2026-08-30T08:17:18Z"