diff --git a/pkgs/by-name/rs/rsyslog/package.nix b/pkgs/by-name/rs/rsyslog/package.nix
index dccac3ae60ff..1c4611076eda 100644
--- a/pkgs/by-name/rs/rsyslog/package.nix
+++ b/pkgs/by-name/rs/rsyslog/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   pkg-config,
   autoreconfHook,
   autoconf-archive,
@@ -72,6 +73,15 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-JXSz8waOaVXrlO9WQ+K2pbhYXMjqp3IJ/1y8Hi5fceU=";
   };
 
+  patches = [
+    # Remove with rsyslog 8.2608.0 or newer.
+    (fetchpatch {
+      name = "CVE-2026-19654.patch";
+      url = "https://github.com/rsyslog/rsyslog/commit/f7f774228273730ba1075f4cd457ae78303a8f08.patch";
+      hash = "sha256-ww8Ade2eKrQygJduLMPFjxd/fmBnpQ4ePLEzHffPy90=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     autoreconfHook