https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T02:48:05.490258+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-fluentd-2022-39379 BIT-fluentd-2022-39379 — Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration) 2026-10-04T02:48:05.494622+00:00

Affected: Bitnami: fluentd

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.

 https://cve.radiocsirt.org/vuln/euvd-2026-233448 EUVD-2026-233448 2026-10-04T02:48:05.494669+00:00 EUVD-2026-233448 https://cve.radiocsirt.org/vuln/fkie_cve-2022-39379 fkie_cve-2022-39379 2026-10-04T02:48:05.494686+00:00

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.

 https://cve.radiocsirt.org/vuln/ghsa-fppq-mj76-fpj2 GHSA-fppq-mj76-fpj2 — fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration) 2026-10-04T02:48:05.494710+00:00

Affected: RubyGems: fluentd

### Impact A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads.

Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`.

Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability.

### Patches v1.15.3

### Workarounds Do not use `FLUENT_OJ_OPTION_MODE=object`.

### References

* GHSL-2022-067

 https://cve.radiocsirt.org/vuln/gsd-2022-39379 gsd-2022-39379 2026-10-04T02:48:05.494736+00:00 gsd-2022-39379 https://cve.radiocsirt.org/vuln/msrc_cve-2022-39379 msrc_CVE-2022-39379 — Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration) 2026-10-04T02:48:05.494748+00:00 msrc_CVE-2022-39379 https://cve.radiocsirt.org/vuln/oesa-2025-2320 OESA-2025-2320 — rubygem-fluentd security update 2026-10-04T02:48:05.494763+00:00

Affected: openEuler:22.03-LTS-SP4: rubygem-fluentd

Fluentd is an open source data collector designed to scale and simplify log management. It can collect, process and ship many kinds of data in near real-time. Security Fix(es):

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.(CVE-2022-39379)