Red Hat rsyslog Updates Fix an RHEL Denial of Service
Tech GuruQuick Answer
Red Hat has fixed CVE-2026-78002 in rsyslog on the listed RHEL 9 and 10 streams. The flaw is a heap overflow in the RainerScript replace() function that can cause denial of service. Update the branch-specific RPMs and verify that log collection and forwarding still work.
Confirm Scope And Apply The Supported Fix
What to do now: Identify rsyslog receivers and forwarders, preserve queued-log and configuration state, and install the applicable RHEL package update under a logging continuity plan.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Supported RHEL 9 and RHEL 10 rsyslog packages |
|---|---|
| Advisory | RHSA-2026:69541 / RHSA-2026:69540 |
| CVE | CVE-2026-78002 |
| Authoritative release date | RHSA-2026:69541: 2026-09-21T20:19:51+00:00 (CSAF initial release) RHSA-2026:69540: 2026-09-22T00:24:06+00:00 (CSAF initial release) |
| Authority revision date | RHSA-2026:69541: 2026-09-21T20:19:51+00:00 (CSAF revision history) RHSA-2026:69540: 2026-09-22T00:24:06+00:00 (CSAF revision history). CSAF generation timestamps are not advisory revision dates. |
| Affected versions | rsyslog packages in the RHEL streams covered by RHSA-2026:69541 and :69540 before their matching fixed RPM builds. |
| Fixed version | rsyslog 8.2510.0-2.el9_8.2 and 8.2510.0-5.el10_2.2 |
| CVSS base score | 7.5 (CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | The two rsyslog advisories does not state that these flaws are being exploited. That is not confirmation that exploitation has not occurred. |
What Changed
RHSA-2026:69541 supplies the RHEL 10 build; RHSA-2026:69540 supplies the RHEL 9 build. The CVSS impact is availability loss, not a source-confirmed code-execution claim. Red Hat rates the update Important.
What To Validate Now
- Inventory. Record rsyslog package releases, RainerScript rules, input listeners, forwarding destinations, disk queues and service owners.
- Establish applicability. Match the RHEL 10 or RHEL 9 repository to its advisory and assess which configured processing paths use replace(); do not use configuration review as proof that an old build is fixed.
- Remediate. Apply rsyslog 8.2510.0-2.el9_8.2 and 8.2510.0-5.el10_2.2 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the installed/running rsyslog version, send representative local and forwarded messages, and verify receipt, timestamps and queue drain at the destination. Investigate gaps or duplicates before closing the change.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Limit log-input access to trusted senders while arranging the update. Red Hat describes disabling unused network input modules as an interim option, but turning off required receivers can create a monitoring gap. Preserve required logging and plan any service restart, queue recovery and rollback explicitly.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
