# CVE-2026-61548: Rsyslog: mmpstrucdata stack buffer overflow with oversized RFC5424 structured data CVE-2026-61548 is fixed in 16 products on 1 platform, first by DEBIAN-CVE-2026-61548, released July 21, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-61548 - Priority: High - CVSS: 8.1 (Important) - EPSS: 0.0059 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jul 19, 2026 - Weakness: Stack-based Buffer Overflow - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-61548 ## Description Rsyslog is a rocket-fast system for log processing. From 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseSD_PARAM function in plugins/mmpstrucdata/mmpstrucdata.c stores RFC5424 parameter values in a fixed pVal[32 * 1024] stack buffer and calls parsePARAM_VALUE without supplying the destination size. A remote unauthenticated attacker whose crafted RFC5424 message reaches an action using mmpstrucdata can provide a structured-data parameter larger than that buffer when MaxMessageSize permits it, causing an attacker-controlled stack overwrite. Deployments that do not install and use the plugin, or whose effective message-size limit remains below the required threshold, are not affected by this issue. The demonstrated impact is a crash and interruption of log collection; code execution is not demonstrated. This issue is fixed in version 8.2606.0. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | rsyslog Debian 13.5 (trixie) | 8.2504.0-1+deb13u2 | [DEBIAN-CVE-2026-61548](https://patchblox.com/security/data/fix/linux/debian-cve-2026-61548.md) | Jul 21, 2026 | | Linux | rsyslog Debian 14 | 8.2606.0-4 | [DEBIAN-CVE-2026-61548](https://patchblox.com/security/data/fix/linux/debian-cve-2026-61548.md) | Jul 21, 2026 | | Linux | rsyslog Ubuntu 22.04.1 LTS (jammy) | 8.2112.0-2ubuntu2.4 | [rsyslog 8.2112.0-2ubuntu2.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-rsyslog-8.2112.0-2ubuntu2.4.md) | Jul 24, 2026 | | Linux | rsyslog Ubuntu 24.04.5 LTS (noble) | 8.2312.0-3ubuntu9.3 | [rsyslog 8.2312.0-3ubuntu9.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-rsyslog-8.2312.0-3ubuntu9.3.md) | Jul 24, 2026 | | Linux | rsyslog Ubuntu 26.04.1 LTS (resolute) | 8.2512.0-1ubuntu4.1 | [rsyslog 8.2512.0-1ubuntu4.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-rsyslog-8.2512.0-1ubuntu4.1.md) | Aug 12, 2026 | | Linux | rsyslog opensuse-leap 16.0 | 8.2608.0-160000.1.1 | [OPENSUSE-SU-2026:22184-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22184-1.md) | Nov 7, 2026 | | Linux | rsyslog sles 15.6 | 8.2406.0-150600.12.16.1 | [SUSE-SU-2026:3442-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3442-1.md) | Jul 31, 2026 | | Linux | rsyslog sles 15.7 | 8.2608.0-150700.3.24.1 | [SUSE-SU-2026:4611-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4611-1.md) | Nov 7, 2026 | | Linux | rsyslog sles 16.0 | 8.2502.0-160000.4.1 | [SUSE-SU-2026:23145-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23145-1.md) | Aug 5, 2026 | | Linux | rsyslog-clickhouse Ubuntu 26.04.1 LTS (resolute) | 8.2512.0-1ubuntu4.1 | [rsyslog-clickhouse 8.2512.0-1ubuntu4.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-rsyslog-clickhouse-8.2512.0-1ubuntu4.1.md) | Aug 12, 2026 | | Linux | rsyslog-czmq Ubuntu 22.04.1 LTS (jammy) | 8.2112.0-2ubuntu2.4 | [rsyslog-czmq 8.2112.0-2ubuntu2.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-rsyslog-czmq-8.2112.0-2ubuntu2.4.md) | Jul 24, 2026 | | Linux | rsyslog-czmq Ubuntu 24.04.5 LTS (noble) | 8.2312.0-3ubuntu9.3 | [rsyslog-czmq 8.2312.0-3ubuntu9.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-rsyslog-czmq-8.2312.0-3ubuntu9.3.md) | Jul 24, 2026 | | Linux | rsyslog-czmq Ubuntu 26.04.1 LTS (resolute) | 8.2512.0-1ubuntu4.1 | [rsyslog-czmq 8.2512.0-1ubuntu4.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-rsyslog-czmq-8.2512.0-1ubuntu4.1.md) | Aug 12, 2026 | | Linux | rsyslog-docker Ubuntu 26.04.1 LTS (resolute) | 8.2512.0-1ubuntu4.1 | [rsyslog-docker 8.2512.0-1ubuntu4.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-rsyslog-docker-8.2512.0-1ubuntu4.1.md) | Aug 12, 2026 | | Linux | rsyslog-elasticsearch Ubuntu 22.04.1 LTS (jammy) | 8.2112.0-2ubuntu2.4 | [rsyslog-elasticsearch 8.2112.0-2ubuntu2.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-rsyslog-elasticsearch-8.2112.0-2ubuntu2.4.md) | Jul 24, 2026 | | Linux | rsyslog-elasticsearch Ubuntu 24.04.5 LTS (noble) | 8.2312.0-3ubuntu9.3 | [rsyslog-elasticsearch 8.2312.0-3ubuntu9.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-rsyslog-elasticsearch-8.2312.0-3ubuntu9.3.md) | Jul 24, 2026 | | Linux | rsyslog-elasticsearch Ubuntu 26.04.1 LTS (resolute) | 8.2512.0-1ubuntu4.1 | [rsyslog-elasticsearch 8.2512.0-1ubuntu4.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-rsyslog-elasticsearch-8.2512.0-1ubuntu4.1.md) | Aug 12, 2026 | | Linux | rsyslog-gnutls Ubuntu 22.04.1 LTS (jammy) | 8.2112.0-2ubuntu2.4 | [rsyslog-gnutls 8.2112.0-2ubuntu2.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-rsyslog-gnutls-8.2112.0-2ubuntu2.4.md) | Jul 24, 2026 | | Linux | rsyslog-gnutls Ubuntu 24.04.5 LTS (noble) | 8.2312.0-3ubuntu9.3 | [rsyslog-gnutls 8.2312.0-3ubuntu9.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-rsyslog-gnutls-8.2312.0-3ubuntu9.3.md) | Jul 24, 2026 | | Linux | rsyslog-gnutls Ubuntu 26.04.1 LTS (resolute) | 8.2512.0-1ubuntu4.1 | [rsyslog-gnutls 8.2512.0-1ubuntu4.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-rsyslog-gnutls-8.2512.0-1ubuntu4.1.md) | Aug 12, 2026 | | Linux | rsyslog-gssapi Ubuntu 22.04.1 LTS (jammy) | 8.2112.0-2ubuntu2.4 | [rsyslog-gssapi 8.2112.0-2ubuntu2.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-rsyslog-gssapi-8.2112.0-2ubuntu2.4.md) | Jul 24, 2026 | | Linux | rsyslog-gssapi Ubuntu 24.04.5 LTS (noble) | 8.2312.0-3ubuntu9.3 | [rsyslog-gssapi 8.2312.0-3ubuntu9.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-rsyslog-gssapi-8.2312.0-3ubuntu9.3.md) | Jul 24, 2026 | | Linux | rsyslog-gssapi Ubuntu 26.04.1 LTS (resolute) | 8.2512.0-1ubuntu4.1 | [rsyslog-gssapi 8.2512.0-1ubuntu4.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-rsyslog-gssapi-8.2512.0-1ubuntu4.1.md) | Aug 12, 2026 | | Linux | rsyslog-hiredis Ubuntu 22.04.1 LTS (jammy) | 8.2112.0-2ubuntu2.4 | [rsyslog-hiredis 8.2112.0-2ubuntu2.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-rsyslog-hiredis-8.2112.0-2ubuntu2.4.md) | Jul 24, 2026 | | Linux | rsyslog-hiredis Ubuntu 24.04.5 LTS (noble) | 8.2312.0-3ubuntu9.3 | [rsyslog-hiredis 8.2312.0-3ubuntu9.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-rsyslog-hiredis-8.2312.0-3ubuntu9.3.md) | Jul 24, 2026 | | Linux | rsyslog-hiredis Ubuntu 26.04.1 LTS (resolute) | 8.2512.0-1ubuntu4.1 | [rsyslog-hiredis 8.2512.0-1ubuntu4.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-rsyslog-hiredis-8.2512.0-1ubuntu4.1.md) | Aug 12, 2026 | | Linux | rsyslog-kafka Ubuntu 22.04.1 LTS (jammy) | 8.2112.0-2ubuntu2.4 | [rsyslog-kafka 8.2112.0-2ubuntu2.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-rsyslog-kafka-8.2112.0-2ubuntu2.4.md) | Jul 24, 2026 | | Linux | rsyslog-kafka Ubuntu 24.04.5 LTS (noble) | 8.2312.0-3ubuntu9.3 | [rsyslog-kafka 8.2312.0-3ubuntu9.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-rsyslog-kafka-8.2312.0-3ubuntu9.3.md) | Jul 24, 2026 | | Linux | rsyslog-kafka Ubuntu 26.04.1 LTS (resolute) | 8.2512.0-1ubuntu4.1 | [rsyslog-kafka 8.2512.0-1ubuntu4.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-rsyslog-kafka-8.2512.0-1ubuntu4.1.md) | Aug 12, 2026 | | Linux | rsyslog-kubernetes Ubuntu 22.04.1 LTS (jammy) | 8.2112.0-2ubuntu2.4 | [rsyslog-kubernetes 8.2112.0-2ubuntu2.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-rsyslog-kubernetes-8.2112.0-2ubuntu2.4.md) | Jul 24, 2026 | | Linux | rsyslog-kubernetes Ubuntu 24.04.5 LTS (noble) | 8.2312.0-3ubuntu9.3 | [rsyslog-kubernetes 8.2312.0-3ubuntu9.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-rsyslog-kubernetes-8.2312.0-3ubuntu9.3.md) | Jul 24, 2026 | | Linux | rsyslog-kubernetes Ubuntu 26.04.1 LTS (resolute) | 8.2512.0-1ubuntu4.1 | [rsyslog-kubernetes 8.2512.0-1ubuntu4.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-rsyslog-kubernetes-8.2512.0-1ubuntu4.1.md) | Aug 12, 2026 | | Linux | rsyslog-mongodb Ubuntu 22.04.1 LTS (jammy) | 8.2112.0-2ubuntu2.4 | [rsyslog-mongodb 8.2112.0-2ubuntu2.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-rsyslog-mongodb-8.2112.0-2ubuntu2.4.md) | Jul 24, 2026 | | Linux | rsyslog-mongodb Ubuntu 24.04.5 LTS (noble) | 8.2312.0-3ubuntu9.3 | [rsyslog-mongodb 8.2312.0-3ubuntu9.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-rsyslog-mongodb-8.2312.0-3ubuntu9.3.md) | Jul 24, 2026 | | Linux | rsyslog-mongodb Ubuntu 26.04.1 LTS (resolute) | 8.2512.0-1ubuntu4.1 | [rsyslog-mongodb 8.2512.0-1ubuntu4.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-rsyslog-mongodb-8.2512.0-1ubuntu4.1.md) | Aug 12, 2026 | | Linux | rsyslog-mysql Ubuntu 22.04.1 LTS (jammy) | 8.2112.0-2ubuntu2.4 | [rsyslog-mysql 8.2112.0-2ubuntu2.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-rsyslog-mysql-8.2112.0-2ubuntu2.4.md) | Jul 24, 2026 | | Linux | rsyslog-mysql Ubuntu 24.04.5 LTS (noble) | 8.2312.0-3ubuntu9.3 | [rsyslog-mysql 8.2312.0-3ubuntu9.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-rsyslog-mysql-8.2312.0-3ubuntu9.3.md) | Jul 24, 2026 | | Linux | rsyslog-mysql Ubuntu 26.04.1 LTS (resolute) | 8.2512.0-1ubuntu4.1 | [rsyslog-mysql 8.2512.0-1ubuntu4.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-rsyslog-mysql-8.2512.0-1ubuntu4.1.md) | Aug 12, 2026 | | Linux | rsyslog-openssl Ubuntu 22.04.1 LTS (jammy) | 8.2112.0-2ubuntu2.4 | [rsyslog-openssl 8.2112.0-2ubuntu2.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-rsyslog-openssl-8.2112.0-2ubuntu2.4.md) | Jul 24, 2026 | | Linux | rsyslog-openssl Ubuntu 24.04.5 LTS (noble) | 8.2312.0-3ubuntu9.3 | [rsyslog-openssl 8.2312.0-3ubuntu9.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-rsyslog-openssl-8.2312.0-3ubuntu9.3.md) | Jul 24, 2026 | | Linux | rsyslog-openssl Ubuntu 26.04.1 LTS (resolute) | 8.2512.0-1ubuntu4.1 | [rsyslog-openssl 8.2512.0-1ubuntu4.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-rsyslog-openssl-8.2512.0-1ubuntu4.1.md) | Aug 12, 2026 | | Linux | rsyslog-pgsql Ubuntu 22.04.1 LTS (jammy) | 8.2112.0-2ubuntu2.4 | [rsyslog-pgsql 8.2112.0-2ubuntu2.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-rsyslog-pgsql-8.2112.0-2ubuntu2.4.md) | Jul 24, 2026 | | Linux | rsyslog-pgsql Ubuntu 24.04.5 LTS (noble) | 8.2312.0-3ubuntu9.3 | [rsyslog-pgsql 8.2312.0-3ubuntu9.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-rsyslog-pgsql-8.2312.0-3ubuntu9.3.md) | Jul 24, 2026 | | Linux | rsyslog-pgsql Ubuntu 26.04.1 LTS (resolute) | 8.2512.0-1ubuntu4.1 | [rsyslog-pgsql 8.2512.0-1ubuntu4.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-rsyslog-pgsql-8.2512.0-1ubuntu4.1.md) | Aug 12, 2026 | | Linux | rsyslog-relp Ubuntu 22.04.1 LTS (jammy) | 8.2112.0-2ubuntu2.4 | [rsyslog-relp 8.2112.0-2ubuntu2.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-rsyslog-relp-8.2112.0-2ubuntu2.4.md) | Jul 24, 2026 | | Linux | rsyslog-relp Ubuntu 24.04.5 LTS (noble) | 8.2312.0-3ubuntu9.3 | [rsyslog-relp 8.2312.0-3ubuntu9.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-rsyslog-relp-8.2312.0-3ubuntu9.3.md) | Jul 24, 2026 | | Linux | rsyslog-relp Ubuntu 26.04.1 LTS (resolute) | 8.2512.0-1ubuntu4.1 | [rsyslog-relp 8.2512.0-1ubuntu4.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-rsyslog-relp-8.2512.0-1ubuntu4.1.md) | Aug 12, 2026 | | Linux | rsyslog-snmp Ubuntu 22.04.1 LTS (jammy) | 8.2112.0-2ubuntu2.4 | [rsyslog-snmp 8.2112.0-2ubuntu2.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-rsyslog-snmp-8.2112.0-2ubuntu2.4.md) | Jul 24, 2026 | | Linux | rsyslog-snmp Ubuntu 24.04.5 LTS (noble) | 8.2312.0-3ubuntu9.3 | [rsyslog-snmp 8.2312.0-3ubuntu9.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-rsyslog-snmp-8.2312.0-3ubuntu9.3.md) | Jul 24, 2026 | | Linux | rsyslog-snmp Ubuntu 26.04.1 LTS (resolute) | 8.2512.0-1ubuntu4.1 | [rsyslog-snmp 8.2512.0-1ubuntu4.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-rsyslog-snmp-8.2512.0-1ubuntu4.1.md) | Aug 12, 2026 | --- Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.