CVE-2026-44160 json
Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`
published 2026-06-26 4 mo ago modified 2026-10-25 15 d ago also BIT-fluentd-2026-44160 , EUVD-2026-42438 , GHSA-j9cw-hwqf-85w7
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 49%
- public exploits
- 0
- none known
Summary
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's in_http and in_forward plugins support gzip-compressed data but enforce limits only on compressed payloads through settings such as body_size_limit and chunk_size_limit, allowing crafted compressed payloads to decompress in memory to an excessive size and cause denial of service through memory exhaustion. This issue is fixed in version 1.19.3.
Patch / fix
- rubygems fluentd 1.19.3
- bitnami fluentd 1.19.3
- fluentd fluentd 1.19.3
- github.com/fluent/fluentd@f5f2b7c commit
- github.com/fluent/fluentd#5393 pull request
- github.com/fluent/fluentd/releases/tag/v1.19.3 release
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
0.62% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | fluentd | <1.19.3 |
1.19.3 |
| bitnami | fluentd | <1.19.3 |
1.19.3 |
Affected products
- fluent fluentd
Classification
- Weakness
-
- CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
References
-
github.com
/fluent/fluentd/pull/5393
issue-tracking, patch
-
github.com
/fluent/fluentd/commit/f5f2b7cddf8aab3932e6dec9fa367a5f3eb27e10
patch
-
github.com
/fluent/fluentd/security/advisories/GHSA-j9cw-hwqf-85w7
web, mitigation, vendor-advisory, advisory
-
github.com
/fluent/fluentd/releases/tag/v1.19.3
web, product, release-notes, article
-
github.com
/fluent/fluentd
package
-
nvd.nist.gov
/vuln/detail/CVE-2026-44160
web
Sources
- CVE List CVE-2026-44160
- GitHub Advisory GHSA-j9cw-hwqf-85w7
- NVD CVE-2026-44160
- OSV BIT-fluentd-2026-44160
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.