CVE-2026-19654 Red Hat CVE debrief

Who should care

System administrators and security teams responsible for rsyslog installations, particularly those using the imptcp module, should assess exposure and prioritize patching or mitigation to prevent potential service disruption.

Why it matters

CVE-2026-19654 is a high-severity vulnerability in the rsyslog imptcp module that can cause service disruption. System administrators and security teams should prioritize verifying exposure and applying patches or mitigations to prevent potential impacts.

• Potential service disruption due to rsyslogd crashes.
• Need to verify exposure and apply patches or mitigations.
• Possible impact on system logging and monitoring capabilities.

Technical summary

The rsyslog imptcp module has a flaw that can cause rsyslogd to crash due to a crafted input sequence during oversize-frame recovery. The flaw does not have identified confidentiality, integrity, privilege escalation, or code execution impacts. The vulnerability affects systems using the imptcp module, and its exploitation could lead to service disruption, impacting system logging and monitoring capabilities. The CVE record and NVD entry provide details on the vulnerability, its impacts, and affected systems. The vendor has provided advisories for RHSA-2026:66405, RHSA-2026:67583, and RHSA-2026:67584.

Defensive priority

System administrators and security teams should prioritize verifying exposure and applying patches or mitigations to prevent potential service disruption.

Recommended defensive actions

• Verify if the system uses the imptcp module and assess exposure to potential crafted input sequences.
• Review and apply patches or mitigations provided by the vendor to prevent service disruption.
• Monitor system logs for potential exploitation attempts or service disruptions.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impacts, and affected systems. The vulnerability is caused by a flaw in the rsyslog imptcp module that can be triggered by a crafted input sequence during oversize-frame recovery. The CVE record was published on 2026-08-12T21:17:38.517Z and has not been modified since then. The NVD entry provides additional information on the vulnerability, including its CVSS score and severity. The vendor has provided advisories for RHSA-2026:66405, RHSA-2026:67583, and RHSA-2026:

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.