CVE-2026-44160
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
A vulnerability in Fluentd before version 1.19.3 allows a denial of service (DoS) attack via memory exhaustion. The in_http and in_forward plugins support gzip-compressed data but only enforce limits on the compressed payload size, allowing a crafted small compressed packet to decompress into an excessive amount of memory.
Risk Assessment
An attacker can remotely exhaust the memory of the Fluentd server, causing a denial of service and disrupting log collection and processing, which may impact the entire monitoring system.
Recommendation
Immediately upgrade Fluentd to version 1.19.3 or later. If an upgrade is not possible, consider restricting access to the in_http and in_forward plugins to trusted sources only.
Other vulnerabilities in Fluentd
See all- CVE-2026-44024Critical
Fluentd before version 1.19.3 allows dynamically constructing file paths using the ${tag} placeholder. Insufficient validation of ${tag} in file configurations such as the path parameter of the out_file plugin lets attackers send untrusted tags containing path traversal characters to write or overwrite arbitrary files and potentially achieve remote code execution.
- CVE-2017-10906Critical
CVE-2017-10906 describes an escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40. This may allow an attacker to change the terminal UI or execute arbitrary commands on the device.
- CVE-2026-44161High
The out_http output plugin in Fluentd before version 1.19.3 allows placeholders like ${tag} in the endpoint configuration parameter. If the placeholder value comes from untrusted input, an attacker can control the destination hostname of outbound HTTP requests and force them to arbitrary internal services.
- CVE-2026-44025High
Fluentd before version 1.19.3 has a vulnerability in the Monitor Agent plugin (in_monitor_agent) that unintentionally exposes internal instance variables in REST API responses. These variables may contain sensitive data such as database passwords, API keys, or cloud credentials.
Original NVD description (English source)
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's in_http and in_forward plugins support gzip-compressed data but enforce limits only on compressed payloads through settings such as body_size_limit and chunk_size_limit, allowing crafted compressed payloads to decompress in memory to an excessive size and cause denial of service through memory exhaustion. This issue is fixed in version 1.19.3.