ALAS2027-2026-091

References: CVE-2026-19654  CVE-2026-78002 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected. (CVE-2026-19654)

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system. (CVE-2026-78002)

Issue Correction:
Run yum update rsyslog to update your system.

New Packages:

aarch64:
    rsyslog-elasticsearch-8.2604.0-3.amzn2027.0.1.aarch64
    rsyslog-mmjsonparse-debuginfo-8.2604.0-3.amzn2027.0.1.aarch64
    rsyslog-mmkubernetes-debuginfo-8.2604.0-3.amzn2027.0.1.aarch64
    rsyslog-mmtaghostname-8.2604.0-3.amzn2027.0.1.aarch64
    rsyslog-mmnormalize-8.2604.0-3.amzn2027.0.1.aarch64
    rsyslog-openssl-debuginfo-8.2604.0-3.amzn2027.0.1.aarch64
    rsyslog-8.2604.0-3.amzn2027.0.1.aarch64
    rsyslog-mmfields-8.2604.0-3.amzn2027.0.1.aarch64
    rsyslog-mmaudit-debuginfo-8.2604.0-3.amzn2027.0.1.aarch64
    rsyslog-crypto-debuginfo-8.2604.0-3.amzn2027.0.1.aarch64
    rsyslog-debugsource-8.2604.0-3.amzn2027.0.1.aarch64
    rsyslog-elasticsearch-debuginfo-8.2604.0-3.amzn2027.0.1.aarch64
    rsyslog-openssl-8.2604.0-3.amzn2027.0.1.aarch64
    rsyslog-mmjsonparse-8.2604.0-3.amzn2027.0.1.aarch64
    rsyslog-crypto-8.2604.0-3.amzn2027.0.1.aarch64
    rsyslog-mmkubernetes-8.2604.0-3.amzn2027.0.1.aarch64
    rsyslog-mmnormalize-debuginfo-8.2604.0-3.amzn2027.0.1.aarch64
    rsyslog-mmtaghostname-debuginfo-8.2604.0-3.amzn2027.0.1.aarch64
    rsyslog-mmaudit-8.2604.0-3.amzn2027.0.1.aarch64
    rsyslog-debuginfo-8.2604.0-3.amzn2027.0.1.aarch64
    rsyslog-mmfields-debuginfo-8.2604.0-3.amzn2027.0.1.aarch64

noarch:
    rsyslog-doc-8.2604.0-3.amzn2027.0.1.noarch

src:
    rsyslog-8.2604.0-3.amzn2027.0.1.src

x86_64:
    rsyslog-mmkubernetes-debuginfo-8.2604.0-3.amzn2027.0.1.x86_64
    rsyslog-elasticsearch-8.2604.0-3.amzn2027.0.1.x86_64
    rsyslog-crypto-debuginfo-8.2604.0-3.amzn2027.0.1.x86_64
    rsyslog-mmfields-debuginfo-8.2604.0-3.amzn2027.0.1.x86_64
    rsyslog-mmtaghostname-8.2604.0-3.amzn2027.0.1.x86_64
    rsyslog-mmnormalize-debuginfo-8.2604.0-3.amzn2027.0.1.x86_64
    rsyslog-mmjsonparse-debuginfo-8.2604.0-3.amzn2027.0.1.x86_64
    rsyslog-openssl-8.2604.0-3.amzn2027.0.1.x86_64
    rsyslog-mmaudit-debuginfo-8.2604.0-3.amzn2027.0.1.x86_64
    rsyslog-debugsource-8.2604.0-3.amzn2027.0.1.x86_64
    rsyslog-elasticsearch-debuginfo-8.2604.0-3.amzn2027.0.1.x86_64
    rsyslog-mmtaghostname-debuginfo-8.2604.0-3.amzn2027.0.1.x86_64
    rsyslog-openssl-debuginfo-8.2604.0-3.amzn2027.0.1.x86_64
    rsyslog-mmnormalize-8.2604.0-3.amzn2027.0.1.x86_64
    rsyslog-mmfields-8.2604.0-3.amzn2027.0.1.x86_64
    rsyslog-crypto-8.2604.0-3.amzn2027.0.1.x86_64
    rsyslog-mmjsonparse-8.2604.0-3.amzn2027.0.1.x86_64
    rsyslog-mmaudit-8.2604.0-3.amzn2027.0.1.x86_64
    rsyslog-mmkubernetes-8.2604.0-3.amzn2027.0.1.x86_64
    rsyslog-debuginfo-8.2604.0-3.amzn2027.0.1.x86_64
    rsyslog-8.2604.0-3.amzn2027.0.1.x86_64