CVE-2026-44160 Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`
Attackers can cause denial of service in Fluentd by sending gzip-compressed payloads that exhaust memory during decompression.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44160?
CVE-2026-44160 is a high-severity denial of service vulnerability in fluentd, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's in_http and in_forward plugins support gzip-compressed data but enforce limits only on compressed payloads through settings such as body_size_limit and chunk_size_limit, allowing crafted compressed payloads to decompress in memory to an excessive size and cause denial of service through memory exhaustion. This issue is fixed in version 1.19.3.
Weakness: CWE-409
Which versions are affected by CVE-2026-44160?
3 open source packages ship an affected version, including fluentd. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fluentd Bitnami | All versions | 1.19.3 |
fluentd RubyGems | All versions | 1.19.3 |
fluentd RubyGems | All versions | 1.19.3 |
Products include Fluentd Fluentd.
How do I fix CVE-2026-44160?
Upgrade fluentd to 1.19.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-44160 being exploited?
There is no known exploitation of CVE-2026-44160 in the wild and no public exploit code.
Other vulnerabilities in fluentd
- CVE-2026-44024 Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder
- CVE-2017-10906 Fluentd Escape Sequence Injection Vulnerability
- CVE-2020-21514 Fluent Fluentd and Fluent-ui use default password
- CVE-2026-44025 Fluentd: Exposure of Sensitive Information via Monitor Agent API
- CVE-2026-44161 Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`
Sources
Also known as BIT-fluentd-2026-44160, CLEANSTART-2026-PM11258, CLEANSTART-2026-UM68205, GHSA-j9cw-hwqf-85w7, MINI-4jw4-crxh-wffh, MINI-4mpc-h42q-mxrq and 13 more.