Affected: AlmaLinux:9: rsyslog, AlmaLinux:9: rsyslog-crypto, AlmaLinux:9: rsyslog-doc, AlmaLinux:9: rsyslog-elasticsearch, AlmaLinux:9: rsyslog-gnutls, AlmaLinux:9: rsyslog-gssapi, AlmaLinux:9: rsyslog-kafka, AlmaLinux:9: rsyslog-logrotate, AlmaLinux:9: rsyslog-mmaudit, AlmaLinux:9: rsyslog-mmfields and 11 more

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format.

Security Fix(es):

* rsyslog: rsyslog: Denial of service via heap buffer overflow in RainerScript replace() function (CVE-2026-78002)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.

Affected: openEuler:20.03-LTS-SP4: rsyslog

RSYSLOG is the rocket-fast system for log processing.It offers high-performance, great security features and a modular design. While it started as a regular syslogd, rsyslog has evolved into a kind of swiss army knife of logging, being able to accept inputs from a wide variety of sources, transform them, and output to the results to diverse destinations. Security Fix(es):

Rsyslog is an open-source log processing system. The replace() function in the RainerScript scripting language has a heap buffer overflow vulnerability due to incorrect calculation of buffer size (CWE-131), leading to a heap-based buffer overflow (CWE-122). An attacker could exploit this vulnerability to cause denial of service or potential code execution.(CVE-2026-78002)

rsyslog: rsyslog: Denial of service via heap buffer overflow in RainerScript replace() function

postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin curl: libcurl: Unauthorized connection reuse due to a logical error curl: Information disclosure due to uncleared proxy authentication state openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server openssl: RPK server signature algorithm selection can dereference a missing certificate postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound postgresql: Postg…

Affected: Rocky Linux:9: rsyslog

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format.

Security Fix(es):

* rsyslog: rsyslog: Denial of service via heap buffer overflow in RainerScript replace() function (CVE-2026-78002)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected: Ubuntu:Pro:16.04:LTS: rsyslog, Ubuntu:Pro:18.04:LTS: rsyslog, Ubuntu:Pro:20.04:LTS: rsyslog, Ubuntu:22.04:LTS: rsyslog, Ubuntu:24.04:LTS: rsyslog, Ubuntu:26.04:LTS: rsyslog

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in rsyslog ausnutzen, um einen Denial of Service Angriff durchzuführen.