A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.

A heap buffer overflow vulnerability exists in rsyslog's RainerScript replace() function. An unauthenticated remote attacker can exploit this flaw by sending specially crafted syslog messages. The root cause is an incorrect buffer size calculation during string replacement operations, leading to memory corruption. Successful exploitation results in a denial of service (DoS) condition on the affected system. The vulnerability does not require authentication, making it particularly dangerous for internet-exposed syslog infrastructure. It has been reported via Red Hat's security advisory system and the rsyslog GitHub security advisories. A corresponding Bugzilla entry exists for tracking the fix. Organizations relying on rsyslog for log aggregation should prioritize patching this vulnerability promptly.