CVE-2026-55556 – Heap Overflow / DoS – Rsyslog imhttp Module (8.2110.0–8.2603.x)

Summary

CVE-2026-55556 is a heap buffer overflow vulnerability in the optional imhttp input module of Rsyslog, triggered during parsing of HTTP Basic Authentication headers. An unauthenticated remote attacker can send a specially crafted, oversized Basic Authorization header to a listening imhttp endpoint to corrupt heap memory, most likely crashing the rsyslog process and interrupting log collection. The vulnerability carries a CVSS score of 8.2 (High), and only affects deployments that explicitly build, load, and configure the imhttp module with HTTP Basic Authentication enabled — it does not affect default rsyslog installations.

Technical details

• Root cause: In contrib/imhttp/imhttp.c, the auth-header parsing function (parse_auth_header) allocates a working buffer using calloc(0, len) instead of calloc(1, len), resulting in a zero-byte heap allocation.
• Trigger condition: When a client sends an HTTP Basic Authorization header whose base64-encoded credentials exceed the intended buffer size, apr_base64_decode() writes the fully decoded credential data into the zero-length buffer, overflowing into adjacent heap memory.
• Attack vector: Network — a single unauthenticated HTTP request containing an oversized Basic Auth header to an exposed imhttp listener is sufficient to trigger the flaw.
• Impact: The primary and confirmed impact is denial of service (process crash, interrupting syslog/log ingestion). The actual severity of memory corruption can vary with allocator behavior, platform, and compiler/hardening options; remote code execution has not been demonstrated.
• Exploitation prerequisites: rsyslog must be built with the imhttp module, the module must be installed and explicitly loaded via configuration, and HTTP Basic Authentication must be enabled on the imhttp listener. Standard/default rsyslog installations, where imhttp is not loaded, are not affected.

Affected software

• Rsyslog versions 8.2110.0 through 8.2603.x (inclusive), when built with and using the imhttp module with HTTP Basic Authentication enabled.
• Rsyslog 8.2604.0 and later are not affected — the vulnerable authentication-parsing code was fixed/removed as part of a broader auth refactor.

Severity

• CVSS v4.0 Base Score: 8.2 (High)
• Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
• Key drivers: network-exploitable, low attack complexity, no privileges or user interaction required, high impact to availability.

Mitigation and recommended actions

• Immediate: Upgrade Rsyslog to version 8.2604.0 or later, where the flawed allocation was corrected.
• If upgrading is not immediately possible:
  • Apply the minimal upstream patch to affected builds, changing the buffer allocation in imhttp.c from calloc(0, len) to calloc(1, len).
  • Disable or avoid loading the imhttp module if it is not required.
  • If imhttp with Basic Authentication must remain in use, restrict network access to the imhttp listener (e.g., firewall rules, internal-only exposure) to trusted management networks until the upgrade is applied.
  • Monitor for repeated rsyslog crashes/restarts that may indicate exploitation attempts against exposed imhttp endpoints.

References

• GitHub Security Advisory GHSA-947w-69ph-mc2r (Rsyslog imhttp Heap Overflow)
• CVE-2026-55556 Record (CVEProject cvelistV5)
• oss-security Mailing List Disclosure