Hello, rsyslog has disclosed GHSA-48f2-29wv-5jgc, an output length overflow in RainerScript replace(). The three-argument form of wrap() uses the same helper. This is not exposed by rsyslog's default small-message configuration.
An affected deployment needs both an explicit ruleset that passes attacker-influenced values to replace() or three-argument wrap(), and a maxMessageSize large enough to accept the source and replacement values. The reported TCP trigger used a 131,133-byte message with a 200k limit. The original sizing pass held the expanded result length in a 32-bit unsigned integer. An expansion to exactly 2^32 bytes wrapped that length to zero, causing an undersized allocation. The construction pass then wrote replacement bytes beyond the allocated buffer. The reporter demonstrated a network-triggered heap out-of-bounds write and daemon termination under ASan. No code execution, confidentiality loss, or integrity loss has been demonstrated. The upstream fix in grammar/rainerscript.c computes the result length in size_t and rejects any result above maxMessageSize before allocation. The affected replace() and wrap() calls return an empty string and issue a warning when this limit is reached. Two-argument wrap() is also bounded. The private advisory listed rsyslog >= 8.6.0 through 8.2608.0 and later vulnerable daily builds as affected. The reporter checked this range; upstream has not independently verified the first affected release. A fixed daily-stable build dated 2026-10-13 is planned; its availability and exact package identifiers should be checked in the published advisory. The next scheduled stable release will also include the fix. CVSS v3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). This score describes the vulnerable path once configured; the required configuration is unusual in ordinary deployments. Until updated, operators can keep the default small maximum message size, avoid attacker-influenced replacement values in affected rulesets, or restrict access to affected listeners. Advisory: https://github.com/rsyslog/rsyslog/security/advisories/GHSA-48f2-29wv-5jgc CVE: requested through GitHub; identifier pending. Reporter: Akhil Koul (akoul). AI assistance was used in the report and upstream fix preparation. The reporter manually verified the ASan reproducer and negative control. Regards, Rainer Gerhards rsyslog project
