CVE-2026-44160CWE-409

Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`

High · published July 8, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
49.0
In the wild
Unconfirmed
What it is

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's in_http and in_forward plugins support gzip-compressed data but enforce limits only on compressed payloads through settings such as body_size_limit and chunk_size_limit, allowing crafted compressed payloads to decompress in memory to an excessive size and cause denial of service through memory exhaustion. This issue is fixed in version 1.19.3.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00620 · 49.0th percentile
Weakness
CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification)
Published
2026-07-08T21:24Z
EPSS history
Timeline
  • 08 JUL 21:24Z
    Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`
    cvelistv5