Read the docs
TI-2026-32145 Aliases CVE-2026-44163GHSA-2jc5-xhx8-qj6h

fluent-plugin-opentelemetry: Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry`

Priority LOW 30CWE-409Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

fluent-plugin-opentelemetry is a Fluentd input and output plugin for forwarding OpenTelemetry Protocol data. Prior to 0.5.3, the in_opentelemetry HTTP input read the entire incoming request body and decompressed payloads into memory without enforcing maximum size thresholds. When an OpenTelemetry ingestion endpoint was exposed to an untrusted network, an attacker could send an excessively large request or a highly compressed payload that expanded in memory. The resulting memory exhaustion could cause the operating system to terminate the Fluentd process, disrupting all log collection and forwarding on the affected node. This issue is fixed in version 0.5.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00418 36th percentileScored 2026-11-07
Fix Fixed fluent-plugin-opentelemetry (fluent-plugins-nursery): 0.5.3fluent-plugin-opentelemetry (RubyGems): 0.5.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fluent-plugins-nurseryfluent-plugin-opentelemetrybefore 0.5.30.5.3Patch availableCNA
—fluent-plugin-opentelemetry (RubyGems)before 0.5.30.5.3Patch availableGHSA-2jc5-xhx8-qj6h
  • fluent-plugin-opentelemetry Vendorfluent-plugins-nursery Affected before 0.5.3 Fixed in 0.5.3 Patch available CNA
  • fluent-plugin-opentelemetry (RubyGems) Vendor— Affected before 0.5.3 Fixed in 0.5.3 Patch available GHSA-2jc5-xhx8-qj6h

Remediation

  • Fix · CNA fluent-plugin-opentelemetry (fluent-plugins-nursery) Fixed in 0.5.3
  • Fix · GHSA-2jc5-xhx8-qj6h fluent-plugin-opentelemetry (RubyGems) Fixed in 0.5.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44163
  2. 2026-10-03 Alias added: GHSA-2jc5-xhx8-qj6h

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences