CVE-2026-44162

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44162
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44162.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44162
Aliases
Downstream
Published
2026-09-14T17:45:37Z
Modified
2026-09-16T03:45:59Z
Severity
  • 2.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in `in_s3`
Details

fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. From 0.7.0 to 1.8.4, the in_s3 input plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompression_size_limit. An attacker with permission to upload objects to the monitored S3 bucket can provide a highly compressed object that expands excessively when Fluentd processes it. The resulting memory exhaustion can cause the operating system to terminate the Fluentd process and disrupt all log collection on the affected node. This issue is fixed in version 1.8.5.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-409"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44162.json"
}
References

Affected packages

Git / github.com/fluent/fluent-plugin-s3

Affected ranges

Type
GIT
Repo
https://github.com/fluent/fluent-plugin-s3
Events
Introduced
312274d67fded91d716553a056c9c916995d96cd
Fixed
e085aee001d15bcc4bd073507e74075e30550fd0
Fixed
9dd608f7461db45f753f4c98ee8071fcb2b0de35
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.7.0"
        },
        {
            "fixed": "1.8.5"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.7.0
v0.7.1
v0.7.2
v0.8.0
v0.8.0.rc1
v1.*
v1.0.0
v1.0.0.rc1
v1.0.0.rc2
v1.0.0.rc3
v1.0.0.rc4
v1.0.0.rc5
v1.0.0.rc6
v1.0.0.rc7
v1.0.0.rc8
v1.1.0
v1.1.1
v1.1.10
v1.1.11
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v1.2.0
v1.2.1
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.4.0
v1.5.0
v1.5.1
v1.6.0
v1.6.1
v1.7.0
v1.7.1
v1.7.2
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44162.json"