CVE-2026-39879
SQL injection in syslog-ng SQL destionation driver
- State
- Published
- Severity
- 7.1 High
- Published
- Jul 20, 2026
- Updated
- Jul 21, 2026
- Reserved
- Apr 7, 2026
Description
Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured.
Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and syslog-ng Store Box 7.8
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.1 High | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H | GitHub_M |
Weaknesses
- CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences
Affected Products
| Product | Versions |
|---|---|
syslog-ngsyslog-ng |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.