CVE-2026-44160: Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's inhttp and inforward plugins support gzip-compressed data but enforce limits only on compressed payloads through settings such as bodysizelimit and chunksizelimit, allowing crafted compressed payloads to decompress in memory to an excessive size and cause denial of service through memory exhaustion. This issue is fixed in version 1.19.3.
Other sources
Fluentd's inhttp and inforward plugins support receiving gzip-compressed data. While Fluentd correctly enforces size limits on the incoming compressed payloads (e.g., via bodysizelimit or chunksizelimit), it was discovered that there is no limit enforced on the size of the decompressed data.
If a Fluentd instance is exposed to untrusted networks, an attacker can send a maliciously crafted, highly compressed payload. When Fluentd attempts to decompress this payload in memory, it will expand to an excessive size, completely bypassing the intended payload size limits.
Impact This vulnerability allows for a Denial of Service (DoS) attack via memory exhaustion. The rapid memory consumption during decompression can easily lead to an Out-of-Memory kill of the Fluentd process by the operating system. This results in the disruption of all log collection and forwarding capabilities on the affected node.
Patches v1.19.3
Workarounds If an immediate upgrade is not possible, users are strongly advised to apply the following mitigations:
1. Restrict Network Access Ensure that Fluentd input ports (such as 9880 for inhttp and 24224 for inforward) are deployed within a closed, trusted network. Use firewall rules (e.g., iptables, AWS Security Groups) to block access from untrusted networks or instances. 2. Use a Reverse Proxy If developers must expose HTTP ingestion to external sources, place a robust reverse proxy (such as Nginx) in front of Fluentd. Configure the proxy to handle the gzip decompression and enforce strict limits on both compressed and uncompressed body sizes before passing the traffic to Fluentd.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/fluentdto a version that resolves this vulnerability.Fixed in 1.19.3 - Upgrade
Upgrade
Fluentdto a version that resolves this vulnerability.Fixed in 1.19.3 - Compensating control
Ensure Fluentd input ports (such as 9880 for in_http and 24224 for in_forward) are deployed within a closed, trusted network.
- Compensating control
If HTTP ingestion must be exposed externally, place a robust reverse proxy (e.g., Nginx) in front of Fluentd and configure it to handle gzip decompression and enforce strict limits on both compressed and uncompressed body sizes before passing traffic to Fluentd.
- Compensating control
Use firewall rules (e.g., iptables or AWS Security Groups) to block access to Fluentd from untrusted networks/instances.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44160?
The severity of CVE-2026-44160 is high, with a CVSS score of 7.5.
How do I fix CVE-2026-44160?
To fix CVE-2026-44160, update to the latest version of Fluentd that addresses this vulnerability.
What components of Fluentd are affected by CVE-2026-44160?
CVE-2026-44160 affects the `in_http` and `in_forward` plugins of Fluentd.
What types of attacks does CVE-2026-44160 potentially enable?
CVE-2026-44160 may allow attackers to exploit the lack of decompressed payload size limits, leading to denial-of-service conditions.
Is CVE-2026-44160 exploitable remotely?
Yes, CVE-2026-44160 is exploitable remotely as it involves incoming data to plugins with no enforced decompressed size limit.