Most recent entries from all

BIT-fluentd-2022-39379 — Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)

Affected: Bitnami: fluentd

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.

EUVD-2026-233448

fkie_cve-2022-39379

GHSA-fppq-mj76-fpj2 — fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)

Affected: RubyGems: fluentd

### Impact A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads.

Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`.

Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability.

### Patches v1.15.3

### Workarounds Do not use `FLUENT_OJ_OPTION_MODE=object`.

### References

* GHSL-2022-067

gsd-2022-39379

msrc_CVE-2022-39379 — Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)

msrc_CVE-2022-39379

OESA-2025-2320 — rubygem-fluentd security update

Affected: openEuler:22.03-LTS-SP4: rubygem-fluentd

Fluentd is an open source data collector designed to scale and simplify log management. It can collect, process and ship many kinds of data in near real-time. Security Fix(es):