High severity7.5NVD Advisory· Published Jul 8, 2026· Updated Jul 13, 2026
CVE-2026-44160
CVE-2026-44160
Description
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's in_http and in_forward plugins support gzip-compressed data but enforce limits only on compressed payloads through settings such as body_size_limit and chunk_size_limit, allowing crafted compressed payloads to decompress in memory to an excessive size and cause denial of service through memory exhaustion. This issue is fixed in version 1.19.3.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
fluentdRubyGems | < 1.19.3 | 1.19.3 |
Affected products
17- osv-coords15 versionspkg:apk/chainguard/kube-fluentd-operatorpkg:apk/chainguard/ruby3.2-fluentd-kubernetes-daemonset-1.19-kinesispkg:apk/chainguard/ruby3.2-kube-logging-operator-fluentd-outputspkg:apk/chainguard/ruby3.3-fluentd-kubernetes-daemonset-1.19-kinesispkg:apk/chainguard/ruby3.4-fluentd-kubernetes-daemonset-1.19-kinesispkg:apk/chainguard/ruby3.4-kube-logging-operator-fluentd-outputspkg:apk/chainguard/ruby4.0-fluentd-kubernetes-daemonset-1.19-kinesispkg:apk/wolfi/kube-fluentd-operatorpkg:apk/wolfi/ruby3.2-fluentd-kubernetes-daemonset-1.19-kinesispkg:apk/wolfi/ruby3.2-kube-logging-operator-fluentd-outputspkg:apk/wolfi/ruby3.3-fluentd-kubernetes-daemonset-1.19-kinesispkg:apk/wolfi/ruby3.4-fluentd-kubernetes-daemonset-1.19-kinesispkg:apk/wolfi/ruby3.4-kube-logging-operator-fluentd-outputspkg:apk/wolfi/ruby4.0-fluentd-kubernetes-daemonset-1.19-kinesispkg:bitnami/fluentd
< 1.18.2-r72+ 14 more
- (no CPE)range: < 1.18.2-r72
- (no CPE)range: < 1.19.2.1.1-r5
- (no CPE)range: < 6.7.0-r7
- (no CPE)range: < 1.19.3.1.0-r0
- (no CPE)range: < 1.19.3.1.0-r0
- (no CPE)range: < 6.7.0-r7
- (no CPE)range: < 1.19.3.1.0-r0
- (no CPE)range: < 1.18.2-r72
- (no CPE)range: < 1.19.2.1.1-r5
- (no CPE)range: < 6.7.0-r7
- (no CPE)range: < 1.19.3.1.0-r0
- (no CPE)range: < 1.19.3.1.0-r0
- (no CPE)range: < 6.7.0-r7
- (no CPE)range: < 1.19.3.1.0-r0
- (no CPE)range: < 1.19.3
Patches
Vulnerability mechanics
References
5- github.com/fluent/fluentd/commit/f5f2b7cddf8aab3932e6dec9fa367a5f3eb27e10nvdPatch
- github.com/fluent/fluentd/pull/5393nvdIssue TrackingPatch
- github.com/advisories/GHSA-j9cw-hwqf-85w7ghsaADVISORY
- github.com/fluent/fluentd/security/advisories/GHSA-j9cw-hwqf-85w7nvdMitigationVendor AdvisoryWEB
- github.com/fluent/fluentd/releases/tag/v1.19.3nvdProductRelease NotesWEB
News mentions
0No linked articles in our index yet.