CVE-2026-39879
HIGH SEVERITYCVSS Score & Metrics
Base Score
7.1 / 10
Vector String
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Vulnerability Description
Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured.
Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and syslog-ng Store Box 7.8
Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and syslog-ng Store Box 7.8
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-150
Source
NVD
Vendor
syslog-ng
Product
syslog-ng
Discussion (0)
Add Comment
No comments yet. Be the first!