CVE-2026-44162

fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. From 0.7.0 to 1.8.4, the ins3 input plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompressionsizelimit. An attacker with permission to upload objects to the...

CVE-2026-44162 fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in `in_s3`

fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. From 0.7.0 to 1.8.4, the ins3 input plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompressionsizelimit. An attacker with permission to upload objects to the...

FluentD-TD-agent-Exploit-CVE-2020-28169

FluentD-TD-agent-WindowsExploit V4.0.1 CVE-2020-28169 権限昇格を引き起こす安全でないフォルダ権限 ダウンロードURL: https://td-agent-package-browser.herokuapp.com/4/windows...

CVE-2026-44024_exploit

CVE-2026-44024 — Escritura arbitraria de archivos por Path Traversal en outfile $tag de Fluentd Escritura arbitraria de archivos sin autenticación en el plugin outfile de Fluentd mediante el marcador de posición $tag. outfile permite a los operadores parametrizar la ruta de salida con un marcador...

ndff

ndff 面向 fluentd 的 nDPI ndff 是一个带有 nDPI 库的、面向 fluentd 的流收集器。 ndff 是基于 nDPI 中的示例 ndpiReader 实现的。 概述 nDPI 是一个用于深度包检测的开源 LGPLv3 库。 ndpiReader 是 nDPI 中的一个示例，具有以下功能。 从数据包（pcap 文件或设备）中检测协议 应用 BPF 过滤器过滤选定的流量 将数据包的内容以 JSON 格式导出到文件 等等…… 如果能在 fluentd 中分析 nDPI 的结果，将会非常有用。 因此，ndff 将数据包聚合成类似 NetFlow 的流，并以 JSON...

Critical Photon OS Security Update - PHSA-2026-5.0-91-0960

Updates of 'coreutils', 'glib', 'rubygem-fluentd', 'alsa-lib', 'go' packages of Photon OS have been released...

GO-2025-4188 vulnerabilities

Vulnerabilities for packages: sonobuoy, hello-world-golang, aws-flb-firehose, kube-fluentd-operator, go-discover, gostatsd, php-fpmexporter, src-fingerprint, newrelic-nri-statsd, aws-flb-kinesis, aws-flb-cloudwatch, docker-credential-gcr, kubeflow, neuvector-dbgen, kpt, terraform-provider-google,...

GHSA-4MRV-5P47-P938 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset...

CVE-2026-54522 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset...

CVE-2026-54522 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset...

GHSA-4MRV-5P47-P938 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, ruby3.2-fluentd-kubernetes-daemonset...

CLEANSTART-2026-ZB89546 Security fixes in ruby-fluentd-1.19 1.19.2-r3

Package ruby-fluentd-1.19 version 1.19.2-r3 fixes 9 vulnerabilities: ghsa-h8w8-99g7-qmvj, ghsa-6wx8-w4f5-wwcr, ghsa-wv3x-4vxv-whpp, CVE-2026-54904, CVE-2026-54905...

CVE-2026-54680

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...

Logging operator has Fluentd configuration injection that allows remote code execution

Summary The Fluentd configuration renderer in Logging operator writes strings from CRDs such as Flow directly into fluent.conf without escaping them. As a result, a user who can create Flow resources can inject Fluentd configuration by providing values that contain newlines. In the confirmed path...

GHSA-MJQF-28PH-426H Logging operator has Fluentd configuration injection that allows remote code execution

Summary The Fluentd configuration renderer in Logging operator writes strings from CRDs such as Flow directly into fluent.conf without escaping them. As a result, a user who can create Flow resources can inject Fluentd configuration by providing values that contain newlines. In the confirmed path...

CVE-2026-54680 Logging operator has Fluentd configuration injection that allows remote code execution

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...

CVE-2026-54680 Logging operator has Fluentd configuration injection that allows remote code execution

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow recordtransformer.records values directly into fluent.conf without...

CVE-2026-54680

The CVE concerns the Kubernetes Logging Operator (Logging operator) where FluentRender (FluentRender) in Fluentd config rendering writes CRD values (e.g., Flow record_transformer.records) directly into fluent.conf without escaping. This allows a user who can create Flow resources to inject a blo...

GHSA-GG3M-VVP2-P2C5 vulnerabilities

Vulnerabilities for packages: kubo, flux-image-automation-controller, elvish, external-dns, grafana-image-renderer, cluster-api-azure-controller, rancher-fleet, speedtest-go, metrics-server, aws-nuke, opentelemetry-collector-contrib, cert-manager, kine, kube-fluentd-operator, falco-no-driver,...

CVE-2026-46600 vulnerabilities

Vulnerabilities for packages: kubo, flux-image-automation-controller, elvish, external-dns, grafana-image-renderer, cluster-api-azure-controller, rancher-fleet, speedtest-go, metrics-server, aws-nuke, opentelemetry-collector-contrib, cert-manager, kine, kube-fluentd-operator, falco-no-driver,...