CVE-2026-55556 Rsyslog: Heap buffer overflow in imhttp plugin Basic Authentication handling
An unauthenticated remote attacker can cause a denial of service in Rsyslog by sending oversized credentials to the optional imhttp module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55556?
CVE-2026-55556 is a high-severity memory corruption vulnerability in rsyslog, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parse_auth_header function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc(0, len) when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes that pointer to apr_base64_decode. An unauthenticated remote attacker can send an oversized encoded credential to an imhttp endpoint configured for Basic Authentication, causing decoded data to overwrite adjacent heap memory before credential validation. Deployments that do not install, load, and use imhttp with Basic Authentication are not affected. The demonstrated impact is a process crash that interrupts log collection, and code execution has not been demonstrated. This issue is fixed in version 8.2604.0.
Weakness: CWE-122
Which versions are affected by CVE-2026-55556?
How do I fix CVE-2026-55556?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-55556 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55556 exists.
Sources
Also known as AZL-104994, DEBIAN-CVE-2026-55556, ECHO-295e-562f-90a0, GHSA-947w-69ph-mc2r.