CVE-2026-44163
fluent-plugin-opentelemetry is a Fluentd input and output plugin for forwarding OpenTelemetry Protocol data. Prior to 0.5.3, the in_opentelemetry HTTP input read the entire incoming request body and decompressed payloads into memory without enforcing maximum size thresholds. When an OpenTelemetry ingestion endpoint was exposed to an untrusted network, an attacker could send an excessively large request or a highly compressed payload that expanded in memory. The resulting memory exhaustion could cause the operating system to terminate the Fluentd process, disrupting all log collection and forwarding on the affected node. This issue is fixed in version 0.5.3.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- EPSS probability
- 0.34%
- CWE
- CWE-409
- Published
- 2026-09-15
- Last modified
- 2026-09-16
Affected products
- fluent-plugins-nursery fluent-plugin-opentelemetry
Weakness type
Related vulnerabilities
- CVE-2025-66471 — urllib3 Streaming API improperly handles highly compressed data
- CVE-2026-22776 — cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb
- CVE-2026-5132 — Unbounded zlib decompression in Calls SDP WebSocket messages
- CVE-2026-15814 — Uploading a crafted image causes excessive memory allocation in the Mattermost Server
- CVE-2026-14298 — Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost
- CVE-2026-10819 — Mattermost Server Denial of Service via Animated GIF Emoji Upload
- CVE-2026-21441 — urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
- CVE-2024-7765 — Denial of Service in h2oai/h2o-3