This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-19654 →

DEBIAN-CVE-2026-19654

A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame r...

Original description

The description as published by the source.

A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 rsyslog

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 rsyslog

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2504.0-1+deb13u1"}]}]

Debian:14 rsyslog

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2608.0-1"}]}]

References

advisory security-tracker.debian.org