CVE-2026-44160 Details

A denial-of-service vulnerability has been identified in Fluentd versions prior to 1.19.3, specifically within the in_http and in_forward plugins. These plugins allow the reception of gzip-compressed data. While Fluentd enforces size limits on incoming compressed payloads, it does not impose similar restrictions on the size of decompressed data. This oversight can be exploited by sending maliciously crafted, highly compressed payloads that expand to an excessive size when decompressed, bypassing the intended payload size limits and causing memory exhaustion. The rapid consumption of memory can lead to an Out-of-Memory kill of the Fluentd process, disrupting log collection and forwarding capabilities on the affected node.

Users can upgrade to Fluentd version 1.19.3, where this vulnerability has been patched. If an immediate upgrade is not possible, it is recommended to restrict network access to Fluentd input ports or use a reverse proxy to handle gzip decompression and enforce size limits before the traffic reaches Fluentd.