diff --git a/imptcp-guard-regex-framing-at-line-start.patch b/imptcp-guard-regex-framing-at-line-start.patch
new file mode 100644
index 0000000..54c63ad
--- /dev/null
+++ b/imptcp-guard-regex-framing-at-line-start.patch
@@ -0,0 +1,11 @@
+--- rsyslog-8.2604.0/plugins/imptcp/imptcp.c	2026-04-20 11:25:09.423912802 +0200
++++ rsyslog-8.2604.0-patched/plugins/imptcp/imptcp.c	2026-08-11 08:12:25.841724364 +0200
+@@ -1020,7 +1020,7 @@ static rsRetVal ATTR_NONNULL() processDa
+         pThis->iCurrLine = pThis->iMsg;
+     } else {
+         const int isMatch = !regexec(&inst->start_preg, (char *)pThis->pMsg + pThis->iCurrLine, 0, NULL, 0);
+-        if (isMatch) {
++        if (pThis->iCurrLine > 0 && isMatch) {
+             DBGPRINTF("regex match (%d), framing line: %s\n", pThis->iCurrLine, pThis->pMsg);
+             strcpy((char *)pThis->pMsg_save, (char *)pThis->pMsg + pThis->iCurrLine);
+             pThis->iMsg = pThis->iCurrLine - 1;
diff --git a/rsyslog.spec b/rsyslog.spec
index a56996d..ae89d3c 100644
--- a/rsyslog.spec
+++ b/rsyslog.spec
@@ -6,7 +6,7 @@
 Summary: Enhanced system logging and kernel message trapping daemon
 Name: rsyslog
 Version: 8.2604.0
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: GPL-3.0-or-later AND Apache-2.0
 URL: http://www.rsyslog.com/
 Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz
@@ -23,6 +23,7 @@ Patch0: imfile-inotify-fd-release-on-delete.patch
 Patch1: omelasticsearch-pqc-tls.patch
 Patch2: omelasticsearch-apply-tls-opts-during-detection.patch
 Patch3: imjournal-warn-on-missing-MESSAGE-field.patch
+Patch4: imptcp-guard-regex-framing-at-line-start.patch
 
 BuildRequires: make
 BuildRequires: gcc
@@ -249,6 +250,7 @@ container metadata.
 %patch -P 1 -p1
 %patch -P 2 -p1
 %patch -P 3 -p1
+%patch -P 4 -p1
 
 # Unpack qpid-proton for rhel
 %setup -q -D -T -b 5
@@ -520,6 +522,10 @@ done
 
 
 %changelog
+* Tue Aug 11 2026 Attila Lakatos <alakatos@redhat.com> - 8.2604.0-4
+- Backport: imptcp: guard regex framing match at line start
+  Resolves: RHEL-212706
+
 * Mon Jul 13 2026 Attila Lakatos <alakatos@redhat.com> - 8.2604.0-3
 - Backport: warn when imjournal fails to retrieve MESSAGE field from journal entry
   Resolves: RHEL-194529