From b31b0b7100368243b22ac378f0bc893da2149547 Mon Sep 17 00:00:00 2001
From: Azure Linux Security Servicing Account
 <azurelinux-security@microsoft.com>
Date: Sun, 16 Aug 2026 06:41:32 +0000
Subject: [PATCH] Patch rsyslog for CVE-2026-19654

---
 SPECS/rsyslog/CVE-2026-19654.patch | 27 +++++++++++++++++++++++++++
 SPECS/rsyslog/rsyslog.spec         |  7 ++++++-
 2 files changed, 33 insertions(+), 1 deletion(-)
 create mode 100644 SPECS/rsyslog/CVE-2026-19654.patch

diff --git a/SPECS/rsyslog/CVE-2026-19654.patch b/SPECS/rsyslog/CVE-2026-19654.patch
new file mode 100644
index 00000000000..795cd69e3f1
--- /dev/null
+++ b/SPECS/rsyslog/CVE-2026-19654.patch
@@ -0,0 +1,27 @@
+From cb2473e6b68709d67c787a400509c329cf93a1df Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Sun, 16 Aug 2026 06:35:29 +0000
+Subject: [PATCH] imptcp: guard regex framing match at line start
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: AI Backport of https://github.com/rsyslog/rsyslog/commit/07b3c40a5a78c79ed9109251f842ca7e955dd586.patch
+---
+ plugins/imptcp/imptcp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/plugins/imptcp/imptcp.c b/plugins/imptcp/imptcp.c
+index 351dee0..1225e6d 100644
+--- a/plugins/imptcp/imptcp.c
++++ b/plugins/imptcp/imptcp.c
+@@ -1053,7 +1053,7 @@ processDataRcvd_regexFraming(ptcpsess_t *const __restrict__ pThis,
+ 		pThis->iCurrLine = pThis->iMsg;
+ 	} else {
+ 		const int isMatch = !regexec(&inst->start_preg, (char*)pThis->pMsg+pThis->iCurrLine, 0, NULL, 0);
+-		if(isMatch) {
++		if(pThis->iCurrLine > 0 && isMatch) {
+ 			DBGPRINTF("regex match (%d), framing line: %s\n", pThis->iCurrLine, pThis->pMsg);
+ 			strcpy((char*)pThis->pMsg_save, (char*) pThis->pMsg+pThis->iCurrLine);
+ 			pThis->iMsg = pThis->iCurrLine - 1;
+-- 
+2.45.4
+
diff --git a/SPECS/rsyslog/rsyslog.spec b/SPECS/rsyslog/rsyslog.spec
index 19114214a31..0b002d1eeb5 100644
--- a/SPECS/rsyslog/rsyslog.spec
+++ b/SPECS/rsyslog/rsyslog.spec
@@ -3,7 +3,7 @@
 Summary:        Rocket-fast system for log processing
 Name:           rsyslog
 Version:        8.2308.0
-Release:        5%{?dist}
+Release:        6%{?dist}
 License:        GPLv3+ AND ASL 2.0
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -17,6 +17,7 @@ Source3:        rsyslog.conf
 Source4:        https://www.rsyslog.com/files/download/rsyslog/%{name}-doc-%{base_version}.0.tar.gz
 Source5:        rsyslog.logrotate
 Patch0:         issue5158.patch
+Patch1:         CVE-2026-19654.patch
 BuildRequires:  autogen
 BuildRequires:  curl-devel
 BuildRequires:  gnutls-devel
@@ -81,6 +82,7 @@ BuildRequires: net-snmp-devel
 %prep
 # Unpack the code source tarball
 %setup -q
+%patch 1 -p1
 %patch 0 -p1
 # Unpack the documentation tarball in the folder created above
 %setup -q -a 4 -T -D
@@ -204,6 +206,9 @@ fi
 %{_libdir}/rsyslog/omsnmp.so
 
 %changelog
+* Sun Aug 16 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 8.2308.0-6
+- Patch for CVE-2026-19654
+
 * Tue Jan 06 2026 Pawel Winogrodzki <pawelwi@microsoft.com> - 8.2308.0-5
 - Bumping release to rebuild with new 'net-snmp' libs.