Fluentd: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Medium 5.8
  CVE-2026-25765

  Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url

  Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Prior to 2.14.1, Faraday's build_exclusive_url method (in lib/faraday/connection.rb) uses Ruby's URI#merge to combine the connection's base URL with a use…

  lostisland faraday logstash-9.3-iamguarded-compat logstash-9.3 Debian Ubuntu Azure Linux Wolfi RubyGems
  Feb 9, 2026
• Medium 5.3
  CVE-2025-14762

  AWS SDK for Ruby's S3 Encryption Client has a Key Commitment Issue

  Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadat…

  AWS AWS SDK for Ruby kube-fluentd-operator kube-fluentd-operator-default-config Ubuntu Wolfi RubyGems
  Dec 17, 2025

Revision history

1. 2026-02-26 #1

   Initiale Fassung

References

• fluent-package v6.0.2 release vom 2026-02-26
  https://www.fluentd.org/blog/fluent-package-v6.0.2-has-been-released