CVE-2026-44162 Details

A denial-of-service vulnerability has been identified in the Fluentd plugin fluent-plugin-s3, specifically in versions 0.7.0 through 1.8.4. The issue arises in the in_s3 input plugin, which reads and decompresses highly compressed files from Amazon S3, such as those in gzip, lzma2, and lzop formats. The plugin fails to impose a limit on the size of the decompressed data, allowing an attacker with permission to upload files to the monitored S3 bucket to exploit this behavior. By uploading a maliciously crafted, highly compressed file, the attacker can cause excessive memory consumption when Fluentd processes the file. This rapid memory exhaustion can lead the operating system to terminate the Fluentd process, disrupting log collection on the affected node.

Users can upgrade to fluent-plugin-s3 version 1.8.5, which addresses the vulnerability by introducing a decompression size limit. If an immediate upgrade is not possible, it is recommended to apply strict IAM access controls to restrict write access to the S3 bucket, allowing only trusted services and administrators to upload files.