Graylog syslog parser vulnerability enables log evasion

According to the GitHub Security Advisory database, a high-severity vulnerability has been identified in Graylog's syslog message parser for Fortigate devices. The issue affects the parsing of key-value formatted syslog messages, allowing attackers to overwrite fields or generate invalid messages that Graylog will discard. This creates a risk of log evasion, potentially obscuring malicious activity.

The vulnerability has been addressed in Graylog versions 6.3.12, 7.0.7, and 7.1.2. Users are advised to upgrade to one of these versions or later to mitigate the issue. Graylog Cloud users are already protected, as the platform has been patched. No workarounds are available, making an upgrade essential for remediation.

Operators should review their current Graylog version and plan an upgrade to one of the patched releases. Additionally, those using Graylog Enterprise or Security editions can check the Indexing and Processing Failures Index to identify messages that may have been discarded due to parsing errors. This step is crucial to ensure no critical logs have been missed during the vulnerability window.