rsyslog overflow and graphql-go DoS reports

Security disclosures on 2026-08-30 covered a heap buffer overflow in rsyslog and multiple unauthenticated denial-of-service flaws in graphql-go. The reports concern processing of untrusted input under specific conditions in logging and GraphQL parsing code.

rsyslog RainerScript heap buffer overflow

A heap buffer overflow tracked as CVE-2026-78002 was disclosed in rsyslog, affecting the RainerScript replace() and wrap() functions. The issue occurs under non-default configurations when handling untrusted input. Operators running rsyslog with such setups should assess exposure and apply available mitigations.

graphql-go quadratic DoS from syntax errors

An unauthenticated quadratic CPU-exhaustion denial-of-service was reported in graphql-go versions 0.8.1 and earlier, triggered by a single syntax error. No fix is available at the time of disclosure. Services using the library for untrusted GraphQL input face potential resource exhaustion.

graphql-go quadratic DoS via suggestion scans

A separate unauthenticated quadratic CPU-exhaustion denial-of-service was disclosed in graphql-go 0.8.1 and earlier via full-schema scans performed by KnownTypeNamesRule error suggestions. Crafted input can force expensive processing across the schema. Applications relying on this package remain exposed without a patch.

graphql-go stack overflow from scalar validation

Public disclosure described an unpatched denial-of-service in graphql-go/graphql versions 0.8.1 and earlier stemming from improper scalar input-type validation. The flaw permits type confusion that leads to unrecoverable stack overflow through fmt recursion. Unauthenticated attackers can trigger the condition against vulnerable GraphQL endpoints.