Search: CVE-2026-61548

Rsyslog versions from 7.5.4 up to but not including 8.2606.0 contain a vulnerability in the optional mmpstrucdata plugin. The vulnerability arises from the parseSD_PARAM function using a fixed-size stack buffer without proper bounds checking, allowing a remote unauthenticated attacker to send an oversized RFC5424 structured-data parameter that causes a stack overwrite. This can lead to a crash and interruption of log collection. Systems not using the plugin or with message size limits below the threshold are not affected. The issue is fixed in version 8.2606.0.