The vulnerability CVE-2026-55841 in Graylog's FortiGate syslog message parser stemmed from improper handling of field-like text within quoted values. The core issue resided in a custom wrapper class, org.graylog2.inputs.codecs.GLFortiGateSyslogEvent, specifically its getFields() method. This method attempted to filter out 'invalid' fields using regular expressions (KV_PATTERN and QUOTED_KV_PATTERN) if a value contained an equals sign or specific patterns. This custom logic was flawed, allowing attackers to embed keys like srcip, dstip, date, time, and tz within quoted values in syslog messages. When processed by this vulnerable getFields() method, these embedded keys could either remove legitimate top-level fields, overwrite them, or cause the entire message to be discarded, effectively enabling an attacker to manipulate security logs or evade detection. The org.graylog2.inputs.codecs.SyslogCodec.parse() method was the direct caller of this vulnerable GLFortiGateSyslogEvent.getFields() method. The fix involved completely removing the GLFortiGateSyslogEvent class and its custom parsing logic, and instead, SyslogCodec.parse() was modified to directly use the FortiGateSyslogEvent class from the upstream syslog4j library (which was also updated to version 0.9.63). This change effectively bypassed the problematic custom parsing, thereby resolving the vulnerability. Therefore, both GLFortiGateSyslogEvent.getFields() (the source of the flawed logic) and SyslogCodec.parse() (the entry point that invoked the flawed logic) are identified as vulnerable functions.
Miggo AI
