Read the docs
TI-2021-18025 Aliases CVE-2021-41186GHSA-hwhf-64mh-r662

ReDoS vulnerability in parser_apache2

Priority LOW 37CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 7 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. This issue is patched in version 1.14.2 There are two workarounds available. Either don't use parser_apache2 for parsing logs (which cannot guarantee generated by Apache), or put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable `FLUENT_PLUGIN` or `--plugin` option of fluentd).

Why it matters now

EPSS 0.02215 82nd percentileScored 2026-11-07
Fix Partial fluentd (fluent): 1.14.2fluentd (RubyGems): 1.14.2Red Hat: 7 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
fluentfluentd0.14.14 to before 1.14.21.14.2Patch availableCNA
—fluentd (RubyGems)0.14.14 to before 1.14.21.14.2Patch availableGHSA-hwhf-64mh-r662
  • fluentd Vendorfluent Affected 0.14.14 to before 1.14.2 Fixed in 1.14.2 Patch available CNA
  • fluentd (RubyGems) Vendor— Affected 0.14.14 to before 1.14.2 Fixed in 1.14.2 Patch available GHSA-hwhf-64mh-r662

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fluentd:fluentd:*:*:*:*:*:*:*:*0.14.14 – 1.14.1Vulnerablefluent
  • cpe:2.3:a:fluentd:fluentd:*:*:*:*:*:*:*:* Versions 0.14.14 – 1.14.1 Vulnerable ·fluent

Remediation

  • Fix · CNA fluentd (fluent) Fixed in 1.14.2
  • Fix · GHSA-hwhf-64mh-r662 fluentd (RubyGems) Fixed in 1.14.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 10 (Newton) Operational ToolsAffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens) Operational ToolsAffectedNo fix planned: Out of support scope

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41186
  2. 2026-10-03 Alias added: GHSA-hwhf-64mh-r662

References

Advisory 3

Other 4

  • TI-2022-18753 Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration) CVSS 3.1CRITICAL 9.8
  • TI-2026-32064 Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder CVSS 3.1CRITICAL 9.8
  • TI-2017-07995 Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may… CVSS 3.0CRITICAL 9.8
  • TI-2020-14076 An issue was discovered in Fluent-ui v.1.2.2 allows attackers to gain escalated… CVSS 3.1HIGH 8.8
  • TI-2026-32142 Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward` CVSS 3.1HIGH 7.5
  • TI-2026-32065 Fluentd: Exposure of Sensitive Information via Monitor Agent API CVSS 3.1HIGH 7.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences