Red HatCVE-2026-19654
Red Hat Enterprise Linux: privilege escalation
High7.5CVE-2026-19654 · Published Aug 12, 2026 · updated Sep 24, 2026
A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 6 Product | all versions | No fix yet |
| all versions | No fix yet | |
| Red Hat Enterprise Linux 7 Product | all versions | No fix yet |
| Red Hat Enterprise Linux 8 Product | all versions | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-125
- www.cve.org/CVERecord?id=CVE-2026-19654
- nvd.nist.gov/vuln/detail/CVE-2026-19654
- access.redhat.com/errata/RHSA-2026:66405
- access.redhat.com/errata/RHSA-2026:67583
- access.redhat.com/errata/RHSA-2026:67584
- access.redhat.com/errata/RHSA-2026:71603
- access.redhat.com/security/cve/CVE-2026-19654
- bugzilla.redhat.com/show_bug.cgi?id=2502868
- github.com/rsyslog/rsyslog/security/advisories/GHSA-cj5r-wh2m-7w29
More Red Hat advisories
All Red Hat| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 12 | Red Hat: mass assignment | High8.5 | No fix yet |
| Aug 12 | Red Hat insights-client. The: excessive privileges | Medium6.5 | No fix yet |
| Aug 12 | Red Hat search-v2-api: denial of service | High7.5 | No fix yet |
| Aug 12 | Red Hat acm-search-v2-rhel9: remote code execution | Critical9.0 | No fix yet |
| Aug 12 | Red Hat open-iscsi. This vulnerability: denial of service | Medium6.5 | No fix yet |
| Aug 12 | Red Hat open-iscsi: integer overflow | Medium6.5 | No fix yet |