Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M
CVE-2026-44163fluent-plugin-opentelemetry: Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry`
Medium 5.3
In plain English
A medium-severity security flaw in fluent-plugin-opentelemetry from fluent-plugins-nursery. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
fluent-plugin-opentelemetry is a Fluentd input and output plugin for forwarding OpenTelemetry Protocol data. Prior to 0.5.3, the in_opentelemetry HTTP input read the entire incoming request body and decompressed payloads into memory without enforcing maximum size thresholds. When an OpenTelemetry ingestion endpoint was exposed to an untrusted network, an attacker could send an excessively large request or a highly compressed payload that expanded in memory. The resulting memory exhaustion could cause the operating system to terminate the Fluentd process, disrupting all log collection and forwarding on the affected node. This issue is fixed in version 0.5.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| RubyGems | fluent-plugin-opentelemetry | 0.5.3 | GHSA-2jc5-xhx8-qj6h |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| fluent-plugins-nursery | fluent-plugin-opentelemetry | < 0.5.3 |
Weakness: CWE-409 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L