CVE-2026-441607.5HighCWE-409

CVE-2026-44160: Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`

fluent · fluentd

No fix listed · Affected: fluentd · Exploitation: not established

ExploitationNot established

Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)

In CISA KEV: not seen
Exploited (reported): not seen
Scanning observed: not seen
Proof of concept public: not seen
Not establishedNothing in the sources we check

0.6%probability of exploitation in the next 30 days

50th percentile

050100

Higher than 50% of scored CVEs

7.5HighCVSS 3.1

LowMediumHighCrit.

DescriptionNVD

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's in_http and in_forward plugins support gzip-compressed data but enforce limits only on compressed payloads through settings such as body_size_limit and chunk_size_limit, allowing crafted compressed payloads to decompress in memory to an excessive size and cause denial of service through memory exhaustion. This issue is fixed in version 1.19.3.

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Improper Handling of Highly Compressed Data (Data Amplification) · Denial of Service
Vendor: fluent
Published: July 2026
Band: Unlikely (under 1%), July 2026

Coverage1 article · 1 outlet

First in our coverage: SecurityOnline, 1 Jul.

1 Jul 02:41
Fluentd fixes critical RCE bug CVE-2026-44024 in log collector
SecurityOnline · first in our coverage · mentions it in passing

New articles also arrive in the RSS feed.