Loading story…
The rsyslog project disclosed a remote denial-of-service flaw in the optional imptcp input module that can let an unauthenticated attacker crash rsyslogd by sending a crafted input sequence during oversize-frame recovery when regex-based framing is enabled. The bug affects rsyslog versions v8.36.0 through v8.2606.0 and daily stable builds published before 2026-07-23 CEST, but only in deployments that explicitly enable imptcp with the non-default framing.delimiter.regex mode; default installations, imtcp, and default imptcp framing modes are not affected. Upstream said the fix would be included in stable release v8.2608.0 after publishing a proposed patch in GitHub PR #7410.
Ubuntu later issued USN-8598-1 to patch multiple rsyslog denial-of-service vulnerabilities in Ubuntu 26.04 LTS, 24.04 LTS, and 22.04 LTS. In addition to the regex-framing imptcp issue, Canonical said rsyslog also improperly handled oversized RFC5424 structured data in the mmpstrucdata module, allowing remote crashes; the notice explicitly identified that second flaw as CVE-2026-61548. Canonical published updated package versions for affected releases and advised users that a standard system update will install the fixes.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Ubuntu published USN-8598-1 to address multiple rsyslog vulnerabilities affecting Ubuntu 26.04 LTS, 24.04 LTS, and 22.04 LTS. The notice included fixed package versions and said the imptcp regex-framing issue could let a remote attacker crash rsyslog and cause a denial of service.
The rsyslog project disclosed a configuration-dependent remote denial-of-service flaw in the optional imptcp input module affecting regex-based framing. The issue affects rsyslog versions v8.36.0 through v8.2606.0, with a proposed upstream fix published in GitHub PR #7410 and a CVE still pending at the time of the advisory.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat disclosed and remediated **CVE-2025-65637**, a Moderate-severity denial-of-service flaw in the Go logging library `github.com/sirupsen/logrus`. The bug is triggered when applications use `Entry.Writer()` to process a single-line payload larger than 64 KB with no newline characters, causing Go's internal `bufio.Scanner` to raise a **"token too long"** error, close the writer pipe, and leave the logging interface unusable. Red Hat said the issue can disrupt logging and degrade application availability, though exploitation depends on a specific non-default usage pattern and affects availability rather than confidentiality or integrity. The vendor published fixes across multiple downstream products and package streams in 2026, including updated Logrus versions `1.8.3`, `1.9.1`, and `1.9.3` or later that chunk oversized input so logging continues even when an error occurs. Red Hat advisories covered affected **RHEL 8** components such as **osbuild-composer** under `RHSA-2026:2687`, as well as **Red Hat OpenStack Services on OpenShift 18.0.18** under `RHSA-2026:7885`, where the Logrus flaw was addressed alongside `CVE-2025-68121` in `crypto/tls`. Updated RPM and SRPM packages were released for impacted RHEL and OpenShift-related environments.
Aug 21, 2026
A flaw in the Linux kernel's netfilter `xt_tcpmss` module, tracked as **`CVE-2026-43190`**, allows a remote attacker to trigger a one-byte out-of-bounds read with a specially crafted TCP packet. The bug is caused by improper validation of the remaining TCP option length before reading the option-length byte, and it can lead primarily to information disclosure with possible limited availability impact. The issue is not broadly reachable across all Linux systems; it affects hosts whose firewall rulesets use the `tcpmss` match. The Linux kernel CVE team published fixes across multiple stable branches, including **5.10.252**, **5.15.202**, **6.1.165**, **6.6.128**, **6.12.75**, **6.18.16**, **6.19.6**, and **7.0**, and advised users to move to the latest stable kernel releases. Red Hat later shipped the fix in **RHSA-2026:44694** for **Red Hat Enterprise Linux 10.0 Extended Update Support** kernel packages, alongside fixes for **`CVE-2026-31684`** and **`CVE-2026-46152`**; updated packages include kernel version **`6.12.0-55.92.1.el10_0`** for `x86_64`, `s390x`, `ppc64le`, and `aarch64`, and Red Hat said affected systems should be rebooted after installation.
Aug 25, 2026
Red Hat released Important-rated kernel and `kernel-rt` updates for affected Red Hat Enterprise Linux (RHEL) 8 and 9 deployments, remediating vulnerabilities including **CVE-2023-0386**, a FUSE flaw that allows a low-privileged local user to escalate privileges, and **CVE-2023-0179**, a Netfilter/nftables integer overflow that can disclose memory addresses and potentially enable root-level code execution. The advisories also address use-after-free defects in Bluetooth L2CAP (**CVE-2022-3564**), ALSA PCM handling (**CVE-2023-0266**), and NFSv4.2 server-side copy handling (**CVE-2022-4379**), the latter of which can permit remote denial of service, as well as procfs stack-overflow and TC mirred CPU soft-lockup flaws. The updates span standard kernels, Real Time kernels, and support-channel variants including EUS, AUS, TUS, SAP, NFV, and telecommunications offerings across x86_64, aarch64, s390x, ppc64le, and selected IBM Power systems. Administrators should deploy the applicable updated kernel packages and reboot systems to activate conventional kernel fixes; RHEL 8 customers covered by RHSA-2023:1659 can instead install the updated `kpatch-patch` module, which loads automatically to live-patch four vulnerabilities without a normal reboot.
Aug 26, 2026