CyberSecBulletin

Syslog-ng vulnerabilities

We track 2 vulnerabilities in Syslog-ng products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on July 20, 2026.

2vulnerabilities
0critical
2high
0exploited
7.3average CVSS score

Latest Syslog-ng vulnerabilities

  • 7.1 High severity

    syslog-ng: Improper Neutralization of Escape, Meta, or Control Sequences

    CVE-2026-39879Syslog-ng

    Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This

  • 7.5 High severity

    syslog-ng: Improper Certificate Validation

    CVE-2024-47619Syslog-ng

    syslog-ng is an enhanced log daemo. Prior to version 4.8.2, `tls_wildcard_match()` matches on certificates such as `foo.*.bar` although that is not allowed. It is also possible to pass partial wildcards such as `foo.a*c.bar` which glib matches but should be av