https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T12:32:06.440885+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bell-cve-2026-39879 BELL-CVE-2026-39879 2026-10-05T12:32:06.533292+00:00

Affected: Alpaquita:23: syslog-ng, Alpaquita:25: syslog-ng, Alpaquita:stream: syslog-ng

 https://cve.radiocsirt.org/vuln/euvd-2026-339218 EUVD-2026-339218 2026-10-05T12:32:06.533360+00:00 EUVD-2026-339218 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39879 fkie_cve-2026-39879 2026-10-05T12:32:06.533387+00:00

Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured.

Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and syslog-ng Store Box 7.8

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-39879 msrc_CVE-2026-39879 — SQL injection in syslog-ng SQL destionation driver 2026-10-05T12:32:06.533433+00:00 msrc_CVE-2026-39879 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-39879 UBUNTU-CVE-2026-39879 2026-10-05T12:32:06.533462+00:00

Affected: Ubuntu:14.04:LTS: syslog-ng, Ubuntu:16.04:LTS: syslog-ng, Ubuntu:18.04:LTS: syslog-ng, Ubuntu:20.04:LTS: syslog-ng, Ubuntu:22.04:LTS: syslog-ng, Ubuntu:24.04:LTS: syslog-ng, Ubuntu:26.04:LTS: syslog-ng

Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and syslog-ng Store Box 7.8