{"id":"UBUNTU-CVE-2026-39879","details":"Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and syslog-ng Store Box 7.8","modified":"2026-07-29T10:18:12.734345534Z","published":"2026-07-20T17:17:00Z","upstream":["CVE-2026-39879"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-39879"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-39879"},{"type":"REPORT","url":"https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-qwf9-6222-m24m"},{"type":"REPORT","url":"https://github.com/syslog-ng/syslog-ng/commit/1e872e301436efa5d3fcd54e7628ac82c57698d2"},{"type":"REPORT","url":"https://github.com/syslog-ng/syslog-ng/commit/1aba7537f0c406090f98a649475acbf517440220"},{"type":"REPORT","url":"https://github.com/syslog-ng/syslog-ng/commit/4b61a0b1dad69368bc3b93b607141708d0036830"},{"type":"REPORT","url":"https://github.com/syslog-ng/syslog-ng/commit/4c0aebf7a1c0a8177bdf4fb67803e19dddc3dbf2"}],"affected":[{"package":{"name":"syslog-ng","ecosystem":"Ubuntu:14.04:LTS","purl":"pkg:deb/ubuntu/syslog-ng?arch=source&distro=trusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.9-1ubuntu1","3.5.1-1","3.5.2-1","3.5.3-1"],"ecosystem_specific":{"binaries":[{"binary_version":"3.5.3-1","binary_name":"syslog-ng"},{"binary_version":"3.5.3-1","binary_name":"syslog-ng-core"},{"binary_version":"3.5.3-1","binary_name":"syslog-ng-mod-amqp"},{"binary_name":"syslog-ng-mod-geoip","binary_version":"3.5.3-1"},{"binary_name":"syslog-ng-mod-json","binary_version":"3.5.3-1"},{"binary_name":"syslog-ng-mod-mongodb","binary_version":"3.5.3-1"},{"binary_name":"syslog-ng-mod-redis","binary_version":"3.5.3-1"},{"binary_version":"3.5.3-1","binary_name":"syslog-ng-mod-smtp"},{"binary_name":"syslog-ng-mod-sql","binary_version":"3.5.3-1"},{"binary_version":"3.5.3-1","binary_name":"syslog-ng-mod-stomp"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-39879.json"}},{"package":{"name":"syslog-ng","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/syslog-ng?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.6-2build1","3.5.6-2.1"],"ecosystem_specific":{"binaries":[{"binary_name":"syslog-ng","binary_version":"3.5.6-2.1"},{"binary_name":"syslog-ng-core","binary_version":"3.5.6-2.1"},{"binary_name":"syslog-ng-mod-amqp","binary_version":"3.5.6-2.1"},{"binary_name":"syslog-ng-mod-geoip","binary_version":"3.5.6-2.1"},{"binary_version":"3.5.6-2.1","binary_name":"syslog-ng-mod-json"},{"binary_name":"syslog-ng-mod-mongodb","binary_version":"3.5.6-2.1"},{"binary_name":"syslog-ng-mod-redis","binary_version":"3.5.6-2.1"},{"binary_name":"syslog-ng-mod-smtp","binary_version":"3.5.6-2.1"},{"binary_name":"syslog-ng-mod-sql","binary_version":"3.5.6-2.1"},{"binary_version":"3.5.6-2.1","binary_name":"syslog-ng-mod-stomp"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-39879.json"}},{"package":{"name":"syslog-ng","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/syslog-ng?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.11.1-1ubuntu1","3.11.1-2ubuntu1","3.13.2-3"],"ecosystem_specific":{"binaries":[{"binary_name":"syslog-ng","binary_version":"3.13.2-3"},{"binary_name":"syslog-ng-core","binary_version":"3.13.2-3"},{"binary_version":"3.13.2-3","binary_name":"syslog-ng-mod-add-contextual-data"},{"binary_version":"3.13.2-3","binary_name":"syslog-ng-mod-amqp"},{"binary_name":"syslog-ng-mod-extra","binary_version":"3.13.2-3"},{"binary_name":"syslog-ng-mod-geoip","binary_version":"3.13.2-3"},{"binary_name":"syslog-ng-mod-getent","binary_version":"3.13.2-3"},{"binary_name":"syslog-ng-mod-graphite","binary_version":"3.13.2-3"},{"binary_name":"syslog-ng-mod-journal","binary_version":"3.13.2-3"},{"binary_name":"syslog-ng-mod-json","binary_version":"3.13.2-3"},{"binary_version":"3.13.2-3","binary_name":"syslog-ng-mod-map-value-pairs"},{"binary_name":"syslog-ng-mod-mongodb","binary_version":"3.13.2-3"},{"binary_version":"3.13.2-3","binary_name":"syslog-ng-mod-python"},{"binary_name":"syslog-ng-mod-redis","binary_version":"3.13.2-3"},{"binary_version":"3.13.2-3","binary_name":"syslog-ng-mod-riemann"},{"binary_name":"syslog-ng-mod-smtp","binary_version":"3.13.2-3"},{"binary_version":"3.13.2-3","binary_name":"syslog-ng-mod-snmptrapd-parser"},{"binary_version":"3.13.2-3","binary_name":"syslog-ng-mod-sql"},{"binary_name":"syslog-ng-mod-stardate","binary_version":"3.13.2-3"},{"binary_name":"syslog-ng-mod-stomp","binary_version":"3.13.2-3"},{"binary_version":"3.13.2-3","binary_name":"syslog-ng-mod-tag-parser"},{"binary_name":"syslog-ng-mod-xml-parser","binary_version":"3.13.2-3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-39879.json"}},{"package":{"name":"syslog-ng","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/syslog-ng?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.19.1-6build1","3.19.1-6build2","3.25.1-1","3.25.1-1ubuntu1","3.25.1-3"],"ecosystem_specific":{"binaries":[{"binary_version":"3.25.1-3","binary_name":"syslog-ng"},{"binary_name":"syslog-ng-core","binary_version":"3.25.1-3"},{"binary_version":"3.25.1-3","binary_name":"syslog-ng-mod-add-contextual-data"},{"binary_name":"syslog-ng-mod-amqp","binary_version":"3.25.1-3"},{"binary_version":"3.25.1-3","binary_name":"syslog-ng-mod-examples"},{"binary_name":"syslog-ng-mod-extra","binary_version":"3.25.1-3"},{"binary_name":"syslog-ng-mod-geoip2","binary_version":"3.25.1-3"},{"binary_name":"syslog-ng-mod-getent","binary_version":"3.25.1-3"},{"binary_version":"3.25.1-3","binary_name":"syslog-ng-mod-graphite"},{"binary_name":"syslog-ng-mod-map-value-pairs","binary_version":"3.25.1-3"},{"binary_name":"syslog-ng-mod-mongodb","binary_version":"3.25.1-3"},{"binary_name":"syslog-ng-mod-pacctformat","binary_version":"3.25.1-3"},{"binary_version":"3.25.1-3","binary_name":"syslog-ng-mod-python"},{"binary_version":"3.25.1-3","binary_name":"syslog-ng-mod-redis"},{"binary_name":"syslog-ng-mod-riemann","binary_version":"3.25.1-3"},{"binary_name":"syslog-ng-mod-smtp","binary_version":"3.25.1-3"},{"binary_name":"syslog-ng-mod-snmptrapd-parser","binary_version":"3.25.1-3"},{"binary_name":"syslog-ng-mod-sql","binary_version":"3.25.1-3"},{"binary_version":"3.25.1-3","binary_name":"syslog-ng-mod-stardate"},{"binary_name":"syslog-ng-mod-stomp","binary_version":"3.25.1-3"},{"binary_name":"syslog-ng-mod-tag-parser","binary_version":"3.25.1-3"},{"binary_name":"syslog-ng-mod-xml-parser","binary_version":"3.25.1-3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-39879.json"}},{"package":{"name":"syslog-ng","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/syslog-ng?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.28.1-2build3","3.28.1-4","3.35.1-1"],"ecosystem_specific":{"binaries":[{"binary_name":"syslog-ng","binary_version":"3.35.1-1"},{"binary_name":"syslog-ng-core","binary_version":"3.35.1-1"},{"binary_version":"3.35.1-1","binary_name":"syslog-ng-mod-add-contextual-data"},{"binary_name":"syslog-ng-mod-amqp","binary_version":"3.35.1-1"},{"binary_name":"syslog-ng-mod-examples","binary_version":"3.35.1-1"},{"binary_name":"syslog-ng-mod-extra","binary_version":"3.35.1-1"},{"binary_version":"3.35.1-1","binary_name":"syslog-ng-mod-geoip2"},{"binary_name":"syslog-ng-mod-getent","binary_version":"3.35.1-1"},{"binary_name":"syslog-ng-mod-graphite","binary_version":"3.35.1-1"},{"binary_version":"3.35.1-1","binary_name":"syslog-ng-mod-http"},{"binary_version":"3.35.1-1","binary_name":"syslog-ng-mod-map-value-pairs"},{"binary_name":"syslog-ng-mod-mongodb","binary_version":"3.35.1-1"},{"binary_name":"syslog-ng-mod-python","binary_version":"3.35.1-1"},{"binary_version":"3.35.1-1","binary_name":"syslog-ng-mod-rdkafka"},{"binary_version":"3.35.1-1","binary_name":"syslog-ng-mod-redis"},{"binary_name":"syslog-ng-mod-riemann","binary_version":"3.35.1-1"},{"binary_version":"3.35.1-1","binary_name":"syslog-ng-mod-slog"},{"binary_version":"3.35.1-1","binary_name":"syslog-ng-mod-smtp"},{"binary_name":"syslog-ng-mod-snmp","binary_version":"3.35.1-1"},{"binary_name":"syslog-ng-mod-sql","binary_version":"3.35.1-1"},{"binary_name":"syslog-ng-mod-stardate","binary_version":"3.35.1-1"},{"binary_version":"3.35.1-1","binary_name":"syslog-ng-mod-stomp"},{"binary_version":"3.35.1-1","binary_name":"syslog-ng-mod-xml-parser"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-39879.json"}},{"package":{"name":"syslog-ng","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/syslog-ng?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.38.1-5","4.3.1-2","4.3.1-2build1","4.3.1-2build4","4.3.1-2build5"],"ecosystem_specific":{"binaries":[{"binary_name":"syslog-ng","binary_version":"4.3.1-2build5"},{"binary_name":"syslog-ng-core","binary_version":"4.3.1-2build5"},{"binary_name":"syslog-ng-mod-add-contextual-data","binary_version":"4.3.1-2build5"},{"binary_name":"syslog-ng-mod-amqp","binary_version":"4.3.1-2build5"},{"binary_version":"4.3.1-2build5","binary_name":"syslog-ng-mod-examples"},{"binary_version":"4.3.1-2build5","binary_name":"syslog-ng-mod-extra"},{"binary_name":"syslog-ng-mod-geoip2","binary_version":"4.3.1-2build5"},{"binary_version":"4.3.1-2build5","binary_name":"syslog-ng-mod-graphite"},{"binary_version":"4.3.1-2build5","binary_name":"syslog-ng-mod-http"},{"binary_version":"4.3.1-2build5","binary_name":"syslog-ng-mod-mongodb"},{"binary_name":"syslog-ng-mod-python","binary_version":"4.3.1-2build5"},{"binary_name":"syslog-ng-mod-rdkafka","binary_version":"4.3.1-2build5"},{"binary_version":"4.3.1-2build5","binary_name":"syslog-ng-mod-redis"},{"binary_name":"syslog-ng-mod-riemann","binary_version":"4.3.1-2build5"},{"binary_name":"syslog-ng-mod-slog","binary_version":"4.3.1-2build5"},{"binary_version":"4.3.1-2build5","binary_name":"syslog-ng-mod-smtp"},{"binary_name":"syslog-ng-mod-snmp","binary_version":"4.3.1-2build5"},{"binary_name":"syslog-ng-mod-sql","binary_version":"4.3.1-2build5"},{"binary_name":"syslog-ng-mod-stardate","binary_version":"4.3.1-2build5"},{"binary_version":"4.3.1-2build5","binary_name":"syslog-ng-mod-stomp"},{"binary_version":"4.3.1-2build5","binary_name":"syslog-ng-mod-xml-parser"},{"binary_version":"4.3.1-2build5","binary_name":"syslog-ng-scl"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-39879.json"}},{"package":{"name":"syslog-ng","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/syslog-ng?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.1-6","4.8.1-7build1","4.8.1-7build2"],"ecosystem_specific":{"binaries":[{"binary_name":"syslog-ng","binary_version":"4.8.1-7build2"},{"binary_name":"syslog-ng-core","binary_version":"4.8.1-7build2"},{"binary_version":"4.8.1-7build2","binary_name":"syslog-ng-mod-add-contextual-data"},{"binary_name":"syslog-ng-mod-amqp","binary_version":"4.8.1-7build2"},{"binary_name":"syslog-ng-mod-examples","binary_version":"4.8.1-7build2"},{"binary_name":"syslog-ng-mod-extra","binary_version":"4.8.1-7build2"},{"binary_version":"4.8.1-7build2","binary_name":"syslog-ng-mod-geoip2"},{"binary_version":"4.8.1-7build2","binary_name":"syslog-ng-mod-graphite"},{"binary_version":"4.8.1-7build2","binary_name":"syslog-ng-mod-http"},{"binary_version":"4.8.1-7build2","binary_name":"syslog-ng-mod-mongodb"},{"binary_name":"syslog-ng-mod-python","binary_version":"4.8.1-7build2"},{"binary_name":"syslog-ng-mod-rdkafka","binary_version":"4.8.1-7build2"},{"binary_name":"syslog-ng-mod-redis","binary_version":"4.8.1-7build2"},{"binary_version":"4.8.1-7build2","binary_name":"syslog-ng-mod-riemann"},{"binary_name":"syslog-ng-mod-slog","binary_version":"4.8.1-7build2"},{"binary_name":"syslog-ng-mod-snmp","binary_version":"4.8.1-7build2"},{"binary_name":"syslog-ng-mod-sql","binary_version":"4.8.1-7build2"},{"binary_name":"syslog-ng-mod-stardate","binary_version":"4.8.1-7build2"},{"binary_name":"syslog-ng-mod-stomp","binary_version":"4.8.1-7build2"},{"binary_name":"syslog-ng-mod-xml-parser","binary_version":"4.8.1-7build2"},{"binary_name":"syslog-ng-scl","binary_version":"4.8.1-7build2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-39879.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"},{"type":"Ubuntu","score":"medium"}]}