CVE-2026-39879CWE-150

SQL injection in syslog-ng SQL destionation driver

High · published July 20, 2026

CVSS v3.1

7.1

EPSS

Percentile

18.1

In the wild

Unconfirmed

What it is

Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured.

Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and syslog-ng Store Box 7.8

The record

Technical detail

CVSS v3.1: 7.1 · HIGH
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0: Not supplied
EPSS: 0.00270 · 18.1th percentile
Weakness: CWE-150 · Improper Neutralization of Escape, Meta, or Control Sequences
Published: 2026-07-20T16:57Z

EPSS history

Timeline

20 JUL 16:57Z
SQL injection in syslog-ng SQL destionation driver
cvelistv5