Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The outhttp output plugin allows the use of placeholders (such as ${tag}) in the endpoint configuration parameter. It was discovered that if the placeholder value is derived from untrusted user input, an attacker can maliciously control the destination hostname of the outbound HTTP requests made by Fluentd. Impact This vulnerability allows for a Server-Side Request Forgery (SSRF) attack. An unauthenticated attacker can force the Fluentd node to send HTTP requests to arbitrary internal services. This can lead to unauthorized access to internal APIs, data exfiltration, or the compromise of cloud metadata endpoints (e.g., AWS IMDS 169.254.169.254). Patches v1.19.3 Workarounds If an immediate upgrade is not possible, users are strongly advised to apply the following mitigations: 1. Avoid Dynamic Hostnames Do not use the placeholder in the endpoint parameter as hostname. 2. Restrict Network Access Use firewall rules (e.g., iptables, AWS Security Groups) to block the Fluentd node from…
Recommended action: Upgrade to 1.19.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Fluentd's inhttp and inforward plugins support receiving gzip-compressed data. While Fluentd correctly enforces size limits on the incoming compressed payloads (e.g., via bodysizelimit or chunksizelimit), it was discovered that there is no limit enforced on the size of the decompressed data. If a Fluentd instance is exposed to untrusted networks, an attacker can send a maliciously crafted, highly compressed payload. When Fluentd attempts to decompress this payload in memory, it will expand to an excessive size, completely bypassing the intended payload size limits. Impact This vulnerability allows for a Denial of Service (DoS) attack via memory exhaustion. The rapid memory consumption during decompression can easily lead to an Out-of-Memory kill of the Fluentd process by the operating system. This results in the disruption of all log collection and forwarding capabilities on the affected node. Patches v1.19.3 Workarounds If an immediate upgrade is not possible, users are strongly…
Recommended action: Upgrade to 1.19.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Fluentd's Monitor Agent plugin (inmonitoragent) exposes internal metrics and plugin information via a REST API. It was discovered that the API response (/api/plugins.json and related endpoints) unintentionally includes internal instance variables of loaded plugins. If any plugins store sensitive information—such as database passwords, API keys, or cloud credentials—in its instance variables, this information may be exposed in plain text to any user or system that has HTTP access to the Monitor Agent API. Impact This vulnerability allows for unauthorized information disclosure. An attacker who can reach the Monitor Agent API port (default: 24220) can potentially extract sensitive credentials used by other Fluentd plugins. The impact severity depends highly on the network configuration (whether the Monitor Agent port is exposed to untrusted networks) and the specific plugins configured in the Fluentd instance. Patches: v1.19.3 Workarounds If usesrs cannot immediately update Fluentd to…
Recommended action: Upgrade to 1.19.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Fluentd allows dynamically constructing file paths using the ${tag} placeholder. It was discovered that validation for this placeholder was insufficient. If a Fluentd instance is configured to receive logs from untrusted sources and uses the ${tag} placeholder in file configurations (such as the path parameter in the outfile plugin), an attacker can inject path traversal characters (e.g., ../). When combined with certain formatting options, this vulnerability allows an attacker to write arbitrary files or overwrite existing files on the system with attacker-controlled content, bypassing intended directory restrictions. Impact This vulnerability allows for Arbitrary File Write, which can be directly escalated to full Remote Code Execution (RCE). An attacker could achieve RCE by overwriting critical system files, injecting executable plugins, or modifying configuration files. The impact is Critical as it can lead to full system compromise without any authentication, depending on the…
Recommended action: Upgrade to 1.19.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable FLUENTOJOPTIONMODE is explicitly set to object. Please note: The option FLUENTOJOPTIONMODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. Patches v1.15.3 Workarounds Do not use FLUENTOJOPTIONMODE=object. References GHSL-2022-067
Recommended action: Upgrade to 1.15.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.
Recommended action: Upgrade to 0.12.41 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact parserapache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. Patches v1.14.2 Workarounds Either of the following: Don't use parserapache2 for parsing logs which cannot guarantee generated by Apache. Put patched version of parserapache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable FLUENTPLUGIN or --plugin option of fluentd). References CVE-2021-41186 GHSA-hwhf-64mh-r662 GHSL-2021-102 https://github.com/fluent/fluentd/blob/master/CHANGELOG.md#v1142
Recommended action: Upgrade to 1.14.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.