QSN-8786-1: rsyslog vulnerability
2026-09-21

Summary:
rsyslog could be made to crash if it received specially crafted network
traffic.

Details:
It was discovered that rsyslog incorrectly calculated buffer sizes when
replacing strings. A remote attacker could possibly use this issue to cause
rsyslog to crash, resulting in a denial of service.

Affected QuantaStor releases:
  6.9.1.001 jammy: rsyslog 8.2112.0-2ubuntu2.2 (fixed in 8.2112.0-2ubuntu2.5)
  6.9.0.464 jammy: rsyslog 8.2112.0-2ubuntu2.2 (fixed in 8.2112.0-2ubuntu2.5)
  6.8.6.015 jammy: rsyslog 8.2112.0-2ubuntu2.2 (fixed in 8.2112.0-2ubuntu2.5)
  6.8.5.018 jammy: rsyslog 8.2112.0-2ubuntu2.2 (fixed in 8.2112.0-2ubuntu2.5)
  6.8.4.038 jammy: rsyslog 8.2112.0-2ubuntu2.2 (fixed in 8.2112.0-2ubuntu2.5)
  6.8.3.018 jammy: rsyslog 8.2112.0-2ubuntu2.2 (fixed in 8.2112.0-2ubuntu2.5)
  6.8.2.002 jammy: rsyslog 8.2112.0-2ubuntu2.2 (fixed in 8.2112.0-2ubuntu2.5)
  6.8.1.007 jammy: rsyslog 8.2112.0-2ubuntu2.2 (fixed in 8.2112.0-2ubuntu2.5)
  6.8.0.205 jammy: rsyslog 8.2112.0-2ubuntu2.2 (fixed in 8.2112.0-2ubuntu2.5)

CVEs: CVE-2026-78002

References:
  https://ubuntu.com/security/notices/USN-8786-1