CVE-2026-39879 | Due to a missing sanitization call in [`afsql_dd_run_query`]… | CVSS 7.1 HIGH

Description

Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and syslog-ng Store Box 7.8

Metadata

CVE ID: CVE-2026-39879
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-04-07 20:32 UTC
Published: 2026-07-20 16:57 UTC
Last updated: 2026-07-21 16:11 UTC
Primary CWE: CWE-150
CWE-150: Improper Neutralization of Escape, Meta, or Control…
Vendor / Product: syslog-ng / syslog-ng
Sources: cve.org · NVD

Severity & Metrics

7.1 HIGH CVSS 3.1

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
syslog-ng	syslog-ng	—	< 4.12

Weakness (CWE)

CWE	Source	Description
CWE-150	cna	CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.1	HIGH	3.1	cna	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

References (1)

https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-qwf9-6222-m24m https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-qwf9-6222-m24m