Vulnerability · Published Jul 8, 2026 · Assigned by GitHub_M

CVE-2026-44160Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`

High 7.5

In plain English

A high-severity security flaw in fluentd from fluent. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 50.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's in_http and in_forward plugins support gzip-compressed data but enforce limits only on compressed payloads through settings such as body_size_limit and chunk_size_limit, allowing crafted compressed payloads to decompress in memory to an excessive size and cause denial of service through memory exhaustion. This issue is fixed in version 1.19.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
RubyGems	fluentd	1.19.3	GHSA-j9cw-hwqf-85w7

Affected products (as reported)

Vendor	Product	Versions
fluent	fluentd	< 1.19.3

Weakness: CWE-409 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/fluent/fluentd/security/advisories/GHSA-j9cw-hwqf-85w7 x_refsource_CONFIRM
https://github.com/fluent/fluentd/pull/5393 x_refsource_MISC
https://github.com/fluent/fluentd/commit/f5f2b7cddf8aab3932e6dec9fa367a5f3eb27e10 x_refsource_MISC
https://github.com/fluent/fluentd/releases/tag/v1.19.3 x_refsource_MISC