CVE-2026-44162
Received Received - Intake

Memory Exhaustion in fluent-plugin-s3 via Compressed Payloads

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. From 0.7.0 to 1.8.4, the in_s3 input plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompression_size_limit. An attacker with permission to upload objects to the monitored S3 bucket can provide a highly compressed object that expands excessively when Fluentd processes it. The resulting memory exhaustion can cause the operating system to terminate the Fluentd process and disrupt all log collection on the affected node. This issue is fixed in version 1.8.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-44162
EUVD
EUVD-2026-77705

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
fluent fluent_plugin_s3 From 0.7.0 (inc) to 1.8.4 (inc)
fluent fluent_plugin_s3 1.8.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-44162 is a Denial of Service (DoS) vulnerability in the fluent-plugin-s3 plugin for Fluentd. It affects the in_s3 input plugin, which reads and decompresses files from Amazon S3 without enforcing a size limit on decompressed payloads. Attackers with S3 upload permissions can exploit this by uploading highly compressed files that expand excessively during decompression, consuming system resources and potentially crashing the Fluentd process.

Detection Guidance

To detect this vulnerability, monitor Fluentd processes for excessive memory usage when processing S3 objects. Check for crashes or OOM kills in Fluentd logs. Inspect S3 buckets for unusually large or compressed files that may trigger decompression issues.

Impact Analysis

This vulnerability can cause memory exhaustion on the affected system, leading to the termination of the Fluentd process. This disrupts all log collection on the node, potentially causing loss of critical logging data and operational disruptions. The impact is limited to availability, with no effect on confidentiality or integrity.

Compliance Impact

This vulnerability primarily causes a Denial of Service (DoS) by exhausting system memory, which disrupts log collection. For compliance standards like GDPR or HIPAA, which require continuous logging and audit trails, this could lead to gaps in required logging, potentially violating data retention or monitoring requirements.

Mitigation Strategies

Upgrade fluent-plugin-s3 to version 1.8.5 or later. If immediate upgrade is not possible, restrict write access to the monitored S3 bucket to trusted services and administrators only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44162. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart