Skip to content

Vendor

syslog-ng vulnerabilities

2 published CVES affecting syslog-ng, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
2
Medium
0
Low
0
Unscored
0
CISA KEV
0
Atom feed of syslog-ng alerts

Products

Latest syslog-ng CVEs

Newest publication first

  1. CVE-2026-39879 SQL injection in syslog-ng SQL destionation driver

    Published
    HighCVSS 7.1 EPSS 0.27%

    Due to a missing sanitization call in afsql_dd_run_query, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Ed...

  2. CVE-2024-47619 tranport: TLS host name wildcard matching too lax

    Published
    HighCVSS 7.5 EPSS 0.38%

    syslog-ng is an enhanced log daemo. Prior to version 4.8.2, tls_wildcard_match() matches on certificates such as foo.*.bar although that is not allowed. It is also possible to pass partial wildcards such as foo.a*c.bar which glib matches but should be avoided / invalidated. This...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.