- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 12
- Public CVEs
- 20
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
12 assets you may test, 5 excluded.
Web 1
- https://www.rsyslog.com
Products and areas 11
- Framing and connection handling on those inputs, including the optional regex-based framing and the octet-counted and newline-delimited paths
- RainerScript and the template engine, including property replacers, the string handling that builds output records, and the configuration parser itself
- SECURITY.md asks for security vulnerabilities through GitHub Private Vulnerability Reporting, with direct email to the maintainer as the alternative. It names no excluded component, so the whole upstream rsyslog tree is in bounds
- The daemon's own privilege handling: it starts as root, and how and when it drops or confines that privilege is part of the surface
- The local input modules, including imuxsock, imjournal, imklog and imfile, which pull records from other processes and from files on disk
- The message parsers: the RFC5424 and RFC3164 syslog parsers, plus the message-modification modules such as mmpstrucdata, mmjsonparse and mmnormalize applied to untrusted records
- The network input modules, including imtcp, imudp, imptcp, imhttp and imrelp, which accept data pre-authentication from any host that can reach the port
- The output modules that hand data to another system, including omfwd, omfile, the database outputs, omelasticsearch and omprog, where an injected field crosses into someone else's parser or process
- The project's build and release machinery, including its GitHub Actions workflows, which are what an attacker would target to reach the artefact rather than the code
- The queue and disk-assisted queue subsystem, where a spool file is written and read by a privileged daemon
- TLS handling on the network inputs and outputs, including certificate and peer-name verification
Out of scope (5)
- Adiscon's commercial products and services, which are separate from the open-source rsyslog repository
- Configuration mistakes such as exposing imtcp to the internet without TLS or access control, which the operator chose
- Distribution packaging and default configuration files rather than defects in upstream rsyslog
- Log injection that amounts to writing misleading text into a log file, absent a parser or downstream consumer that can be made to do something with it
- Resource exhaustion from simply sending a very high volume of legitimate log traffic at a collector configured with no rate limit
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Report through GitHub Private Vulnerability Reporting at github.com/rsyslog/rsyslog/security/advisories/new, which the project's SECURITY.md names as the primary channel and which is enabled on the repository
-
Direct email to the address on the policy page is the documented alternative if the GitHub flow is not workable for you
-
Include the rsyslog.conf or RainerScript configuration that loads the affected module. Every recent finding is module-specific and unreachable without the right input or parser module loaded
-
Say whether the module is enabled by default on Debian, Ubuntu or RHEL, or whether it requires the operator to opt in, because that is the difference between a fleet-wide remote bug and a niche one
-
For anything on the network inputs, provide the raw bytes or a sending script rather than a description of the malformed message
Not accepted
-
Log injection that amounts to writing misleading text into a log file, absent a parser or downstream consumer that can be made to do something with it
-
Resource exhaustion from simply sending a very high volume of legitimate log traffic at a collector configured with no rate limit
-
Configuration mistakes such as exposing imtcp to the internet without TLS or access control, which the operator chose
-
Adiscon's commercial products and services, which are separate from the open-source rsyslog repository
-
Distribution packaging and default configuration files rather than defects in upstream rsyslog
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-19654 | A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected. | High 7.5 | 12 Aug 2026 |
| CVE-2022-24903 | Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This can result in a segfault or some other malfunction. As of our understanding, this vulnerability can not be used for remote code execution. But there may still be a slight chance for experts to do that. The bug occurs when the octet coun | High 8.1 | 6 May 2022 |
| CVE-2011-1488 | A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when $RepeatedMsgReduction was enabled. A local attacker could use this flaw to cause a denial of the rsyslogd daemon service by crashing the service via a sequence of repeated log messages sent within short periods of time. | Medium 5.5 | 14 Nov 2019 |
| CVE-2011-1489 | A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages were logged when multiple rulesets were used and some output batches contained messages belonging to more than one ruleset. A local attacker could cause denial of the rsyslogd daemon service via a log message belonging to more than one ruleset. | Medium 5.5 | 14 Nov 2019 |
| CVE-2011-1490 | A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when multiple rulesets were used and some output batches contained messages belonging to more than one ruleset. A local attacker could cause denial of the rsyslogd daemon service via a log message belonging to more than one ruleset | Medium 5.5 | 14 Nov 2019 |
| CVE-2019-17041 | An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon) but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip | Critical 9.8 | 7 Oct 2019 |
| CVE-2019-17042 | An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon), but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sani | Critical 9.8 | 7 Oct 2019 |
| CVE-2019-17040 | contrib/pmdb2diag/pmdb2diag.c in Rsyslog v8.1908.0 allows out-of-bounds access because the level length is mishandled. | Critical 9.8 | 30 Sep 2019 |
| CVE-2018-16881 | A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcp socket, which would cause rsyslog to crash. Versions before 8.27.0 are vulnerable. | High 7.5 | 25 Jan 2019 |
| CVE-2018-1000140 | rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate. | Critical 9.8 | 23 Mar 2018 |
| CVE-2017-12588 | The zmq3 input and output modules in rsyslog before 8.28.0 interpreted description fields as format strings, possibly allowing a format string attack with unspecified impact. | Critical 9.8 | 6 Aug 2017 |
| CVE-2015-3243 | rsyslog uses weak permissions for generating log files, which allows local users to obtain sensitive information by reading files in /var/log/cron. | Medium 5.5 | 25 Jul 2017 |
| CVE-2014-3634 | rsyslog before 7.6.6 and 8.x before 8.4.1 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash), possibly execute arbitrary code, or have other unspecified impact via a crafted priority (PRI) value that triggers an out-of-bounds array access. | High 7.5 | 2 Nov 2014 |
| CVE-2014-3683 | Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634. | Medium 5.0 | 2 Nov 2014 |
| CVE-2013-4758 | Double free vulnerability in the writeDataError function in the ElasticSearch plugin (omelasticsearch) in rsyslog before 7.4.2 and before 7.5.2 devel, when errorfile is set to local logging, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted JSON response. | Medium 6.8 | 4 Oct 2013 |
| CVE-2011-4623 | Integer overflow in the rsCStrExtendBuf function in runtime/stringbuf.c in the imfile module in rsyslog 4.x before 4.6.6, 5.x before 5.7.4, and 6.x before 6.1.4 allows local users to cause a denial of service (daemon hang) via a large file, which triggers a heap-based buffer overflow. | Low 2.1 | 25 Sep 2012 |
| CVE-2011-3200 | Stack-based buffer overflow in the parseLegacySyslogMsg function in tools/syslogd.c in rsyslogd in rsyslog 4.6.x before 4.6.8 and 5.2.0 through 5.8.4 might allow remote attackers to cause a denial of service (application exit) via a long TAG in a legacy syslog message. | Medium 5.0 | 6 Sep 2011 |
| CVE-2008-5617 | The ACL handling in rsyslog 3.12.1 to 3.20.0, 4.1.0, and 4.1.1 does not follow $AllowedSender directive, which allows remote attackers to bypass intended access restrictions and spoof log messages or create a large number of spurious messages. | High 8.5 | 17 Dec 2008 |
| CVE-2008-5618 | imudp in rsyslog 4.x before 4.1.2, 3.21 before 3.21.9 beta, and 3.20 before 3.20.2 generates a message even when it is sent by an unauthorized sender, which allows remote attackers to cause a denial of service (disk consumption) via a large number of spurious messages. | Medium 5.0 | 17 Dec 2008 |
| CVE-2005-3074 | SQL injection vulnerability in rsyslogd in RSyslog before 1.0.1 and before 1.10.1 allows remote attackers to execute arbitrary SQL commands via crafted syslog messages. | High 7.5 | 27 Sep 2005 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 2 Last 12 months Memory safety 45 % Denial of service 25 % Parsing/validation 20 % Supply chain / CI 10 % Latest advisories Loading the feed Overview rsyslog is the default system log daemon on the Debian, Ubuntu and RHEL/CentOS families, and it does far more than write /var/log/messages . It is a log ingestion and ETL engine whose input modules bind sockets and accept data from anywhere on the network. That makes it the outlier in this category: almost everything else here is a local-privilege target, while rsyslog carries genuine remote pre-authentication surface on an enormous installed base, because a log collector's job is to accept input from hosts it does not trust. The last twelve months carried two CVEs across four published advisories, most of them on that network surface. Adiscon maintains it commercially and runs no bounty. sorona.xyz pays you directly on qualified, reproduced findings. In scope SECURITY.md asks for security vulnerabilities through GitHub Private Vulnerability Reporting, with direct email to the maintainer as the alternative. It names no excluded component, so the whole upstream rsyslog tree is in bounds The network input modules, including imtcp , imudp , imptcp , imhttp and imrelp , which accept data pre-authentication from any host that can reach the port Framing and connection handling on those inputs, including the optional regex-based framing and the octet-counted and newline-delimited paths The local input modules, including imuxsock , imjournal , imklog and imfile , which pull records from other processes and from files on disk The message parsers: the RFC5424 and RFC3164 syslog parsers, plus the message-modification modules such as mmpstrucdata , mmjsonparse and mmnormalize applied to untrusted records RainerScript and the template engine, including property replacers, the string handling that builds output records, and the configuration parser itself The output modules that hand data to another system, including omfwd , omfile , the database outputs, omelasticsearch and omprog , where an injected field crosses into someone else's parser or process TLS handling on the network inputs and outputs, including certificate and peer-name verification The queue and disk-assisted queue subsystem, where a spool file is written and read by a privileged daemon The daemon's own privilege handling: it starts as root, and how and when it drops or confines that privilege is part of the surface The project's build and release machinery, including its GitHub Actions workflows, which are what an attacker would target to reach the artefact rather than the code Out of scope Log injection that amounts to writing misleading text into a log file, absent a parser or downstream consumer that can be made to do something with it Resource exhaustion from simply sending a very high volume of legitimate log traffic at a collector configured with no rate limit Configuration mistakes such as exposing imtcp to the internet without TLS or access control, which the operator chose Adiscon's commercial products and services, which are separate from the open-source rsyslog repository Distribution packaging and default configuration files rather than defects in upstream rsyslog Most-valued findings Memory corruption reachable from a single log message on a network input, which is pre-auth remote code execution surface on the default log daemon of most of the Linux server estate. CVE-2026-55556 in imhttp Basic Auth handling and CVE-2026-61548 in mmpstrucdata are the templates Anything that crashes or hangs the daemon from unauthenticated network input, because losing the log collector is both an availability failure and a way to blind incident response. GHSA-cj5r-wh2m-7w29 did it through optional imptcp regex framing Parser defects in the RFC5424 or RFC3164 paths that let a crafted message desynchronise framing or forge fields other rules act on Injection through the template and property-replacer path into a downstream consumer, particularly a database or search output where the log record becomes a query Privilege handling in the daemon itself, since it starts as root and any failure to drop or confine that turns a parser bug into a root bug Compromise of the build and release path, the class GHSA-8q7v-vw7j-33r8 belongs to as a script injection in the project's GitHub Actions Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through GitHub Private Vulnerability Reporting at github.com/rsyslog/rsyslog/security/advisories/new, which the project's SECURITY.md names as the primary channel and which is enabled on the repository Direct email to [email protected] is the documented alternative if the GitHub flow is not workable for you Include the rsyslog.conf or RainerScript configuration that loads the affected module. Every recent finding is module-specific and unreachable without the right input or parser module loaded Say whether the module is enabled by default on Debian, Ubuntu or RHEL, or whether it requires the operator to opt in, because that is the difference between a fleet-wide remote bug and a niche one For anything on the network inputs, provide the raw bytes or a sending script rather than a description of the malformed message The SECURITY.md covers handling, timeline and credit attribution. Credit is what the project offers, and there is no payment term in it to negotiate Disclosure Coordinated through GitHub private vulnerability reporting and published as a GitHub Security Advisory with a patched release; the SECURITY.md sets out the handling process, the timeline and how reporters are credited. The cadence through mid-2026 shows a maintainer who triages quickly and ships advisories within weeks. Because this is the default log daemon across the Debian and Red Hat families, expect distribution security teams to be coordinating backports in parallel, and hold the detail until those land. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability