Denial of Service Vulnerability in rsyslogd imptcp Module

A vulnerability (CVE-2026-19654) has been identified in the optional imptcp module of rsyslogd. An unauthenticated remote attacker can exploit this flaw by sending a specifically crafted input sequence during the oversize-frame recovery process. This manipulation results in an invalid internal message length calculation, which subsequently triggers an out-of-bounds read and causes the rsyslogd service to crash (Denial of Service). The vulnerability is confined to the imptcp module; standard imtcp configurations and default framing modes within imptcp remain unaffected. This issue impacts multiple versions of Red Hat Enterprise Linux and is documented under CWE-125. Defenders should note that this vulnerability does not allow for privilege escalation, code execution, or unauthorized information disclosure, but it poses a significant availability risk for centralized logging infrastructure.

Impact

The vulnerability results in the disruption of logging services by causing the rsyslogd daemon to terminate unexpectedly. If successfully exploited, this forces a denial-of-service condition on systems relying on rsyslogd for log aggregation and transmission. The scope of impact is high given the critical role rsyslog plays in security monitoring, incident response, and compliance logging across enterprise environments using RHEL distributions.

Recommendation

• Identify all systems running rsyslogd with the optional imptcp module enabled.
• Review configurations to determine if imptcp is necessary; if not, disable the module to mitigate the risk.
• Patch rsyslog packages on affected Red Hat Enterprise Linux 6, 7, 8, 9, and 10 systems immediately upon vendor release of security updates.
• Monitor system logs or infrastructure monitoring tools for unexpected rsyslogd process restarts or termination events.