CVE-2026-39879

Name of the Vulnerable Software and Affected Versions syslog-ng versions prior to 4.12 syslog-ng Premium Edition versions prior to 8.2 syslog-ng Store Box versions prior to 7.8

Description A SQL injection flaw exists when the SQL driver is manually configured, allowing an untrusted source to execute arbitrary SQL commands. This occurs due to a missing sanitization call in the afsql dd run query() function.

Recommendations Update syslog-ng to version 4.12. Update syslog-ng Premium Edition to version 8.2. Update syslog-ng Store Box to version 7.8.