On this page
OSSEC / HIDS Rule 61026
- Rule family: OSSEC / HIDS
- Rule ID: 61026
- Definition status: Present in current source
- Alert message / subject: An application has attempted to set the stack executable, this is either an attack or a very vulnerable application.
- Rule level: 8
- Definition checked: 2026-10-21
Interpretation and response
A program requested an executable stack and the kernel reported denying it. Investigate the binary, its origin and any vendor-documented executable-memory requirement.
An OSSEC/HIDS event records or correlates activity. Blocking depends on the originating application and any separately configured Active Response policy; an alert alone does not prove that an attack was blocked.
This can indicate a security concern or an application compatibility issue. The event alone does not prove a specific vulnerability or compromise.
Documentation
The following guidance was migrated from the historical wiki and reviewed against the rule definition. Legacy ASL product names and interface instructions refer to the versions documented then. Use the current metadata above and your installed configuration when interpreting thresholds, notification settings and response behavior.
Description
A program requested an executable stack and the kernel reported denying it. Investigate the binary, its origin and any vendor-documented executable-memory requirement.
Log examples
Illustrative event summary (not a captured log): OSSEC/HIDS 61026 — An application has attempted to set the stack executable, this is either an attack or a very vulnerable application..
error while loading shared libraries: libcrypto.so.0.9.8: cannot enable executable stack as shared object requires: Permission denied
Troubleshooting
Solutions
Please see this article for solutions if your application has this vulnerability:
ASL error messages (historical reference)
False Positives
Please report this to support if you know this is not an attack.
Additional Information
Similar Rules
Source and revision
Migrated from HIDS_61026, wiki page 532, revision 4843 (20140505). Documentation review: 2026-10-21. An archived wiki status of Active is not a current deployment status.
For assistance, provide the rule ID, installed product and rule version, and a sanitized event to Atomicorp support .