DEBIAN-CVE-2026-39879
Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and syslog-ng Store Box 7.8
DEBIAN-CVE-2026-39879
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-39879
syslog-ng
Source reference: /affected/0/package/name
- Affected versions
- 3.38.1-5
Source reference:
/affected/0/versions3.38.1-5+deb12u1Source reference:
/affected/0/versions4.3.1-1Source reference:
/affected/0/versions4.3.1-2Source reference:
/affected/0/versions4.4.0-1Source reference:
/affected/0/versions4.4.0-2Source reference:
/affected/0/versions4.4.0-3Source reference:
/affected/0/versions4.8.1-1Source reference:
/affected/0/versions4.8.1-2Source reference:
/affected/0/versions4.8.1-3Source reference:
/affected/0/versions4.8.1-4Source reference:
/affected/0/versions4.8.1-5Source reference:
/affected/0/versions4.8.1-6Source reference:
/affected/0/versions4.8.1-7Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
syslog-ng
Source reference: /affected/1/package/name
- Affected versions
- 4.8.1-5
Source reference:
/affected/1/versions4.8.1-5+deb13u1Source reference:
/affected/1/versions4.8.1-6Source reference:
/affected/1/versions4.8.1-7Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
syslog-ng
Source reference: /affected/2/package/name
- Affected versions
- 4.8.1-5
Source reference:
/affected/2/versions4.8.1-6Source reference:
/affected/2/versions4.8.1-7Source reference:
/affected/2/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "syslog-ng",
"purl": "pkg:deb/debian/syslog-ng?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"3.38.1-5",
"3.38.1-5+deb12u1",
"4.3.1-1",
"4.3.1-2",
"4.4.0-1",
"4.4.0-2",
"4.4.0-3",
"4.8.1-1",
"4.8.1-2",
"4.8.1-3",
"4.8.1-4",
"4.8.1-5",
"4.8.1-6",
"4.8.1-7"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-39879.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "syslog-ng",
"purl": "pkg:deb/debian/syslog-ng?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"4.8.1-5",
"4.8.1-5+deb13u1",
"4.8.1-6",
"4.8.1-7"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-39879.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "syslog-ng",
"purl": "pkg:deb/debian/syslog-ng?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"4.8.1-5",
"4.8.1-6",
"4.8.1-7"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-39879.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #57645 · Revision 1
- Added to Heist Feed
- Publisher date