This vulnerability allows an unauthenticated remote peer to crash the rsyslogd daemon on Red Hat Enterprise Linux 10 due to a flaw in the optional imptcp input module. Specifically, a crafted input sequence during oversize-frame recovery can cause an invalid internal message length, terminating rsyslogd. The issue arises only when the imptcp module is explicitly loaded and configured with the non-default framing.delimiter.regex mode, and when an attacker can establish a TCP connection to the listener. No confidentiality, integrity, privilege escalation, or code execution impacts have been identified. Red Hat classifies the severity as moderate for their supported products because default configurations do not meet the conditions for exploitation. No official fix or patch information is provided in the advisory, but mitigations are recommended.

The impact is a denial-of-service (DoS) condition caused by crashing the rsyslogd daemon. There is no confidentiality or integrity impact, no privilege escalation, and no code execution identified. The vulnerability requires specific configuration conditions to be exploitable, which are not present in default Red Hat Enterprise Linux 10 rsyslog installations. Thus, the risk is limited to environments explicitly using the affected imptcp module configuration.

Red Hat recommends the following mitigations for users relying on the imptcp module: (1) Remove the framing.delimiter.regex setting from the affected configuration; (2) Disable the affected imptcp listener or unload the imptcp module if it is not required; (3) Restrict network access to the imptcp listener to trusted senders only. These mitigations reduce the risk of exploitation in the absence of an official patch. Patch status is not confirmed—check the Red Hat advisory for updates.