Memory Exhaustion in fluent-plugin-opentelemetry

Executive Summary

CVE-2026-44163 is a Denial of Service (DoS) vulnerability in the fluent-plugin-opentelemetry plugin affecting the in_opentelemetry HTTP input component. The plugin does not enforce size limits on incoming requests, allowing it to read entire request bodies and decompress payloads into memory without restrictions. When exposed to untrusted networks, attackers can send excessively large HTTP requests or highly compressed payloads that expand significantly during decompression, causing rapid memory consumption and potential process termination due to Out-of-Memory errors.

Useful 0 Not Useful 0

Detection Guidance

Monitor Fluentd process memory usage and logs for Out-of-Memory errors. Check HTTP 413 errors in logs indicating payload size limits being exceeded. Use network monitoring tools to detect unusually large HTTP requests targeting OpenTelemetry ingestion ports (default 4318).

Commands: netstat -tulnp | grep 4318 to check listening ports, ps aux | grep fluentd to monitor Fluentd process, tail -f /var/log/fluent/fluentd.log for errors.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can disrupt log collection and forwarding on the affected node by causing the Fluentd process to crash due to memory exhaustion. If the OpenTelemetry ingestion endpoint is exposed to an untrusted network, attackers can exploit it to trigger a DoS condition, leading to service interruptions and potential loss of critical logging data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade fluent-plugin-opentelemetry to version 0.5.3 or later. Restrict network access to OpenTelemetry ingestion ports using firewalls. Configure reverse proxies with strict size limits before forwarding traffic to Fluentd.

Set body_size_limit and decompression_size_limit parameters to enforce maximum payload sizes. Monitor logs for rejected requests to identify potential attack attempts.

Useful 0 Not Useful 0