azure linux rsyslog vulnerabilities

Latest azure linux rsyslog CVEs

Newest publication first

1. CVE-2026-92709 Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE

   Published 2026-10-22

   High·CVSS 8.1 EPSS 0.38%

   Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically...

2. CVE-2026-61548 Rsyslog: mmpstrucdata stack buffer overflow with oversized RFC5424 structured data

   Published 2026-09-18

   High·CVSS 8.1 EPSS 0.59%

   Rsyslog is a rocket-fast system for log processing. From 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseSD_PARAM function in plugins/mmpstrucdata/mmpstrucdata.c stores RFC5424 parameter values in a fixed pVal[32 * 1024] stack buffer and calls parsePARAM_VALUE witho...

3. CVE-2026-55556 Rsyslog: Heap buffer overflow in imhttp plugin Basic Authentication handling

   Published 2026-09-18

   High·CVSS 8.2 EPSS 0.85%

   Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parse_auth_header function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc(0, len) when an HTTP Basic Authorization value exceeds its fixed work...

4. CVE-2026-78002 Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function

   Published 2026-08-27

   High·CVSS 7.5 EPSS 1.1%

   A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript replace() function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, c...

5. CVE-2026-19654 Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd

   Published 2026-08-12

   High·CVSS 7.5 EPSS 0.77%

   A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege esc...

6. CVE-2026-27601 Underscore.js has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack

   Published 2026-03-03

   High·CVSS 8.2 EPSS 1.1%

   Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the _.flatten and _.isEqual functions use recursion without a depth limit. Under very specific conditions, detailed below, an attacker could exploit this in a Denial of Service (DoS) attack by triggering a s...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.