CVE-2026-44160: Fluentd Gzip Decompression Denial of Service Vulnerability

Technical summary

The vulnerability stems from incomplete input validation in Fluentd's compression handling. The in_http and in_forward plugins enforce size limits (body_size_limit, chunk_size_limit) on the wire-format compressed data, but these limits do not apply to the decompressed payload. An attacker can craft a malicious gzip-compressed message with an extremely high compression ratio—for example, a highly repetitive or sparse payload that compresses to a small size but decompresses to gigabytes—and send it to a listening Fluentd endpoint. The decompression occurs in-memory without secondary validation, leading to uncontrolled memory allocation and eventual out-of-memory conditions. This is a classic Denial-of-Service vector categorized as CWE-409 (Improper Restriction of Rendered UI Layers or Frames), though the core issue is insufficient validation of decompressed data size.

Business impact

Fluentd is widely deployed in containerized environments, Kubernetes clusters, and log-aggregation pipelines. A DoS attack exploiting this vulnerability can silence logging and monitoring across dependent services, obscuring other security incidents and degrading operational visibility. In production environments relying on Fluentd for compliance logging or real-time alerting, an attacker triggering memory exhaustion may delay incident response and breach detection. Organizations using Fluentd to collect metrics and traces from microservices may experience cascading failures if the collector becomes unavailable.

Affected systems

Fluentd versions prior to 1.19.3 are affected. This includes all 1.19.x releases up to and including 1.19.2, as well as earlier 1.18.x and older branches. The vulnerability is triggered only if the in_http or in_forward plugin is enabled and exposed to untrusted input. Fluentd installations that operate purely on local host interfaces or with strict network-level access controls may face reduced risk, but any public or semi-public endpoint accepting compressed data is vulnerable.

Exploitability

Exploitability is high. The attack requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N), can be executed remotely over the network, and involves sending a single crafted HTTP or forward-protocol message. No special privileges or user interaction are needed. The attacker need only identify a Fluentd instance accepting gzip-compressed data and send a payload with a low byte-size-to-decompressed-size ratio. The resulting memory exhaustion will either crash the process or trigger swap thrashing, rendering Fluentd unresponsive within seconds. No public exploit code availability does not reduce the underlying simplicity of the attack.

Remediation

Upgrade Fluentd to version 1.19.3 or later immediately. The patched version enforces decompression-size limits alongside compression-size limits, preventing payloads from expanding beyond configured thresholds. For environments unable to upgrade immediately, configure strict network segmentation to limit which hosts can send data to Fluentd, and reduce the body_size_limit and chunk_size_limit to values appropriate for your workload to minimize the window for exploitation. Disabling the in_http or in_forward plugins if they are not required is an effective mitigation.

Patch guidance

Fluentd 1.19.3 includes the fix and should be deployed as a priority. Check your current version with 'fluentd --version'. Upgrade using your package manager (apt, yum, brew, or Docker) or by downloading directly from the Fluentd GitHub releases page. Test the upgrade in a staging environment to verify compatibility with your plugins and configuration. If you are on an older branch (1.18.x or earlier), consult the Fluentd project for extended support or plan a migration to 1.19.3 or later. Container-based deployments should rebuild images with the new version and redeploy pods.

Detection guidance

Monitor Fluentd process memory usage for sudden spikes or sustained high utilization. Alert on out-of-memory (OOM) kills of the Fluentd process. Review Fluentd logs for decompression errors or warnings related to payload size. On the network side, detect multiple small HTTP POST or forward-protocol messages arriving rapidly with Content-Encoding: gzip or equivalent compression headers, especially if the decompressed size would be orders of magnitude larger than the compressed size. Implement a Web Application Firewall (WAF) rule to flag or rate-limit requests with extreme compression ratios. Query process metrics from your container orchestration platform or monitoring stack to correlate memory spikes with incoming request rates to Fluentd.

Why prioritize this

This is a network-accessible denial-of-service vulnerability affecting a widely deployed data collection tool. The CVSS 7.5 (HIGH) score reflects the ease of exploitation, lack of authentication requirement, and direct impact on availability. While not a data breach risk, the ability to silence logging and monitoring makes it strategically valuable to attackers seeking to obscure malicious activity. Organizations running Fluentd in production should prioritize patching within one to two weeks.

Risk score, explained

CVSS 3.1 score of 7.5 reflects: Attack Vector Network (0.85), Attack Complexity Low (0.77), Privileges Required None (1.0), User Interaction None (1.0), Scope Unchanged (1.0), and Availability Impact High (1.0). The score does not account for Confidentiality or Integrity; the attack causes denial of service only. The absence of KEV (Known Exploited Vulnerability) designation means the vulnerability has not yet been publicly documented as actively exploited in the wild, but this does not diminish the urgency—the attack is trivial to execute once the vector is understood.

Frequently asked questions