Most recent entries from all

BIT-fluentd-2026-44160 — Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`

2026-10-04T01:06:56.130539+00:00

Affected: Bitnami: fluentd

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's in_http and in_forward plugins support gzip-compressed data but enforce limits only on compressed payloads through settings such as body_size_limit and chunk_size_limit, allowing crafted compressed payloads to decompress in memory to an excessive size and cause denial of service through memory exhaustion. This issue is fixed in version 1.19.3.

certfr-2026-avi-0958 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

2026-10-04T01:06:56.130609+00:00

certfr-2026-avi-0958

CLEANSTART-2026-PM11258 — Security fix for CVE-2026-44160 applied in: kube-logging-operator 6.7.0-r2

2026-10-04T01:06:56.130630+00:00

Affected: CleanStart: kube-logging-operator

Security vulnerability affects the kube-logging-operator package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-335489

2026-10-04T01:06:56.130653+00:00

EUVD-2026-335489

fkie_cve-2026-44160

2026-10-04T01:06:56.130665+00:00

GHSA-j9cw-hwqf-85w7 — Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`

2026-10-04T01:06:56.130689+00:00

Affected: RubyGems: fluentd

Fluentd's `in_http` and `in_forward` plugins support receiving gzip-compressed data. While Fluentd correctly enforces size limits on the incoming compressed payloads (e.g., via `body_size_limit` or `chunk_size_limit`), it was discovered that there is no limit enforced on the size of the decompressed data.

If a Fluentd instance is exposed to untrusted networks, an attacker can send a maliciously crafted, highly compressed payload. When Fluentd attempts to decompress this payload in memory, it will expand to an excessive size, completely bypassing the intended payload size limits.

### Impact This vulnerability allows for a **Denial of Service (DoS)** attack via memory exhaustion. The rapid memory consumption during decompression can easily lead to an Out-of-Memory kill of the Fluentd process by the operating system. This results in the disruption of all log collection and forwarding capabilities on the affected node.

### Patches v1.19.3

### Workarounds If an immediate upgrade is not possible, users are strongly advised to apply the following mitigations:

1. Restrict Network Access * Ensure that Fluentd input ports (such as `9880` for `in_http` and `24224` for `in_forward`) are deployed within a closed, trusted network. Use firewall rules (e.g., iptables, AWS Security Groups) to block access from untrusted networks or instances. 2. Use a Reverse Proxy * If developers must expose HTTP ingestion to external sources, place a robust reverse proxy (such as Nginx) in fro…

jvndb-2026-000090

2026-10-04T01:06:56.130726+00:00

Fluentd provided by Fluentd Project contains multiple vulnerabilities listed below.

Path traversal in ${tag} Placeholder (CWE-22) - CVE-2026-44024
Missing authentication for critical function in Monitor Agent API (CWE-306) - CVE-2026-44025
Improper handling of highly compressed data in in_http and in_forward (CWE-409) - CVE-2026-44160
Server-side request forgery in out_http (CWE-918) - CVE-2026-44161
Improper handling of highly compressed data in in_s3 (CWE-409) - CVE-2026-44162
Improper handling of high…

WID-SEC-W-2026-2096 — Fluentd: Mehrere Schwachstellen

2026-10-04T01:06:56.130759+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Fluentd ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen oder einen Denial of Service zu verursachen.