diff --git a/imptcp-guard-regex-framing-at-line-start.patch b/imptcp-guard-regex-framing-at-line-start.patch
new file mode 100644
index 0000000..54c63ad
--- /dev/null
+++ b/imptcp-guard-regex-framing-at-line-start.patch
@@ -0,0 +1,11 @@
+--- rsyslog-8.2604.0/plugins/imptcp/imptcp.c	2026-04-20 11:25:09.423912802 +0200
++++ rsyslog-8.2604.0-patched/plugins/imptcp/imptcp.c	2026-08-11 08:12:25.841724364 +0200
+@@ -1020,7 +1020,7 @@ static rsRetVal ATTR_NONNULL() processDa
+         pThis->iCurrLine = pThis->iMsg;
+     } else {
+         const int isMatch = !regexec(&inst->start_preg, (char *)pThis->pMsg + pThis->iCurrLine, 0, NULL, 0);
+-        if (isMatch) {
++        if (pThis->iCurrLine > 0 && isMatch) {
+             DBGPRINTF("regex match (%d), framing line: %s\n", pThis->iCurrLine, pThis->pMsg);
+             strcpy((char *)pThis->pMsg_save, (char *)pThis->pMsg + pThis->iCurrLine);
+             pThis->iMsg = pThis->iCurrLine - 1;
diff --git a/rsyslog.spec b/rsyslog.spec
index 8fada58..a4bb959 100644
--- a/rsyslog.spec
+++ b/rsyslog.spec
@@ -39,7 +39,7 @@
 Summary: Enhanced system logging and kernel message trapping daemon
 Name: rsyslog
 Version: 8.2604.0
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: GPL-3.0-or-later AND Apache-2.0
 URL: http://www.rsyslog.com/
 Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz
@@ -56,6 +56,7 @@ Patch0: imfile-inotify-fd-release-on-delete.patch
 Patch1: omelasticsearch-pqc-tls.patch
 Patch2: omelasticsearch-apply-tls-opts-during-detection.patch
 Patch3: imjournal-warn-on-missing-MESSAGE-field.patch
+Patch4: imptcp-guard-regex-framing-at-line-start.patch
 
 BuildRequires: make
 BuildRequires: gcc
@@ -394,6 +395,7 @@ This module allows rsyslog to send messages to a RabbitMQ server.
 %patch -P1 -p1
 %patch -P2 -p1
 %patch -P3 -p1
+%patch -P4 -p1
 
 
 %if %{with omamqp1}
@@ -789,6 +791,10 @@ done
 
 
 %changelog
+* Tue Aug 11 2026 Attila Lakatos <alakatos@redhat.com> - 8.2604.0-5
+- Backport: imptcp: guard regex framing match at line start
+  Resolves: RHEL-212698
+
 * Mon Jul 13 2026 Attila Lakatos <alakatos@redhat.com> - 8.2604.0-4
 - Backport: warn when imjournal fails to retrieve MESSAGE field from journal entry
   Resolves: RHEL-193508