An unauthenticated remote attacker can cause a denial of service in rsyslog by exploiting a heap-based buffer overflow in the imhttp module, which requires the module to be configured for Basic Authentication.

The imhttp module contains a heap-based buffer overflow (CWE-122) in the parse_auth_header function, which improperly allocates memory when processing oversized HTTP Basic Authorization credentials. An unauthenticated attacker can trigger this condition by sending a specially crafted request, resulting in a process crash.

The vulnerability carries a CVSS score of 8.2, which reflects the high availability impact (VA:H) of the flaw. Because rsyslog is a critical component for centralizing security and system logs, a successful crash would result in the loss of visibility into system events and potential non-compliance with audit requirements. While code execution has not been demonstrated, the disruption of logging services creates a significant operational risk.

Immediate Action: Update rsyslog to version 8.2604.0 or later to resolve the memory allocation error.

Proactive Monitoring: Monitor system logs for frequent rsyslog process restarts or unexpected crashes, which may indicate attempted exploitation.

Compensating Controls: Disable the imhttp module if it is not strictly required, or ensure that Basic Authentication is not enabled for any exposed imhttp endpoints until the patch can be applied.

Public Exploit Available: No (exploit_available: false)

Given the critical nature of log management systems, administrators should prioritize the deployment of the vendor provided patch. If immediate patching is not feasible, verifying that the imhttp module is either disabled or not configured for Basic Authentication will effectively mitigate the attack vector.