High severity · published Oct 29, 2021
CVE-2021-41186
Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure
7.5
CVSS
2.2%
EPSS
No
On KEV
Description
Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. This issue is patched in version 1.14.2 There are two workarounds available. Either don't use parser_apache2 for parsing logs (which cannot guarantee generated by Apache), or put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable `FLUENT_PLUGIN` or `--plugin` option of fluentd).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
Fluentd · Fluentd
0.14.14 through 1.14.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-41186
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-41186
Release Notes
https://github.com/fluent/fluentd/blob/master/CHANGELOG.md#v1142
Third Party Advisory
https://github.com/fluent/fluentd/security/advisories/GHSA-hwhf-64mh-r662
Broken Link
https://github.com/github/securitylab-vulnerabilities/blob/52dc4a2a828c6dc24231967c2937ad92038184a9/vendor_reports/GHSL-2021-102-fluent-fluentd.md
More from Fluentd
9.8
CVE-2026-44024
Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder
9.8
CVE-2022-39379
Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)
9.8
CVE-2017-10906
Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via…
8.8
CVE-2020-21514
An issue was discovered in Fluent-ui v.1.2.2 allows attackers to gain escalated privileges and execute arbitrary code due to a default password
7.5
CVE-2026-44160
Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`