CVE-2026-39879: Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), syslo
Due to a missing sanitization call in afsql_dd_run_query, syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured.
Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and syslog-ng Store Box 7.8
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-39879
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-398790.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-39879 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
Recent advisories for Due to a
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownCVE-2026-20498: In geniezone, there is a possible escalation of privilege due to a missing permission check. T…nvd · 2026-08-03
- unknownCVE-2026-20497: In geniezone, there is a possible out of bounds write due to a missing bounds check. This coul…nvd · 2026-08-03
- unknownCVE-2026-20496: In geniezone, there is a possible out of bounds read due to a missing bounds check. This could…nvd · 2026-08-03
- unknownCVE-2026-20495: In Bluetooth driver, there is a possible permission bypass due to a missing permission check. …nvd · 2026-08-03
- unknownCVE-2026-20494: In wifi, there is a possible out of bounds read due to a missing bounds check. This could lead…nvd · 2026-08-03
- unknownCVE-2026-20493: In wifi, there is a possible out of bounds write due to a missing bounds check. This could lea…nvd · 2026-08-03
More from NVD Recent CVEs
- unknownCVE-2026-58063: In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from unt…2026-08-03
- unknownCVE-2026-58062: In Bouncy Castle for Java before 1.85, Stapled OCSP response accepted without binding to the c…2026-08-03
- unknownCVE-2026-58061: In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer befor…2026-08-03
- unknownCVE-2026-58060: In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge all…2026-08-03
- unknownCVE-2026-58059: In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 disting…2026-08-03