Back to overview

CVE-2026-44160

HIGH
7.5
CVSS 3.1
Description
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's in_http and in_forward plugins support gzip-compressed data but enforce limits only on compressed payloads through settings such as body_size_limit and chunk_size_limit, allowing crafted compressed payloads to decompress in memory to an excessive size and cause denial of service through memory exhaustion. This issue is fixed in version 1.19.3.

Metadata

CVE ID
CVE-2026-44160
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-05-05 14:39 UTC
Published
2026-07-08 21:24 UTC
Last updated
2026-07-08 21:24 UTC
Primary CWE
CWE-409
CWE-409: Improper Handling of Highly Compressed Data (Data A…
Vendor / Product
fluent / fluentd
Sources
cve.org  ·  NVD

Severity & Metrics

7.5 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products (1)
VendorProductPlatformVersions
fluent fluentd — < 1.19.3
Weakness (CWE)
CWESourceDescription
CWE-409 cna CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
CVSS scores (1)
ScoreSeverityVersionSourceVector
7.5 HIGH 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References (4)
Back to overview