CVE-2026-39879: SQL injection in syslog-ng SQL destionation driver

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-20 · updated 2026-07-23
Weakness: CWE-150

Description

Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and syslog-ng Store Box 7.8

Affected products

syslog-ng: before 4.12

References

https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-qwf9-6222-m24m

Get alerted when CVE-2026-39879 or the next vulnerability affects your stack