CVE-2026-44162

fluent-plugin-s3 (versions 0.7.0 to 1.8.4) is vulnerable to a decompression bomb in its in_s3 input plugin (CWE-409). The plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompression_size_limit. An attacker with permission to upload o...