Description
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's in_http and in_forward plugins support gzip-compressed data but enforce limits only on compressed payloads through settings such as body_size_limit and chunk_size_limit, allowing crafted compressed payloads to decompress in memory to an excessive size and cause denial of service through memory exhaustion. This issue is fixed in version 1.19.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| fluent | fluentd | < 1.19.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | kube-fluentd-operator | 1.18.2-r72 | — |
| Wolfi rolling | ruby3.2-fluentd-kubernetes-daemonset-1.19-kinesis | 1.19.2.1.1-r5 | — |
| Wolfi rolling | ruby3.2-kube-logging-operator-fluentd-outputs +1 | 6.7.0-r7 | — |
| Wolfi rolling | ruby3.3-fluentd-1.17 +2 | No fix yet | — |
| Wolfi rolling | ruby3.3-fluentd-kubernetes-daemonset-1.19-kinesis +2 | 1.19.3.1.0-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | fluentd | < 1.19.3 | 1.19.3 | GHSA-j9cw-hwqf-85w7 |
Advisories 1
- WID-SEC-2026-2096 Fluentd: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 8, 2026