Critical severity · published Nov 2, 2022
CVE-2022-39379
Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)
9.8
CVSS
45%
EPSS
No
On KEV
Description
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)45.0% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
fluentd · fluent
>= 1.13.2, < 1.15.3 · source: vendor, NVD
FE
Fedora · Fedoraproject
37 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-39379
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-39379
Patch
https://github.com/fluent/fluentd/commit/48e5b85dab1b6d4c273090d538fc11b3f2fd8135
Third Party Advisory
https://github.com/fluent/fluentd/security/advisories/GHSA-fppq-mj76-fpj2
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MYD5QV66OLDHES6IKVYYM3Y3YID3VVCO/
More from fluentd
9.8
CVE-2026-44024
Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder
7.5
CVE-2026-44160
Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`
7.5
CVE-2026-44025
Fluentd: Exposure of Sensitive Information via Monitor Agent API
7.2
CVE-2026-44161
Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`