CVE-2026-39879

7.1 Élevée

Publiée le 20/07/2026 à 19:17 · Modifiée le 23/07/2026 à 18:04 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and syslog-ng Store Box 7.8

Traduire en français

Produits concernés

syslog-ng

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.1 Élevée	security-advisories@github.com	`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H`

Faiblesses (CWE)

CWE-150

Références

https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-qwf9-6222-m24m

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories