CVE-2022-38725: Oneidentity Syslog-NG

High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days.

An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service via crafted syslog input that is mishandled by the tcp or network function. syslog-ng Premium Edition 7.0.30 and syslog-ng Store Box 6.10.0 are also affected.

Affected products

• Oneidentity Syslog-NG: before 3.38.1 (fixed in 3.38.1); before 7.0.32 (fixed in 7.0.32)
• Oneidentity Syslog-NG Store Box: before 6.0.5 (fixed in 6.0.5); before 7.0 (fixed in 7.0)

Published 2023-01-23. Last modified 2026-06-17.