Low severity · published Sep 14, 2026
CVE-2026-44162
fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in `in_s3`
2.7
CVSS
0.5%
EPSS
No
On KEV
Description
fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. From 0.7.0 to 1.8.4, the in_s3 input plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompression_size_limit. An attacker with permission to upload objects to the monitored S3 bucket can provide a highly compressed object that expands excessively when Fluentd processes it. The resulting memory exhaustion can cause the operating system to terminate the Fluentd process and disrupt all log collection on the affected node. This issue is fixed in version 1.8.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
fluent-plugin-s3 · fluent
>= 0.7.0, < 1.8.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44162
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44162
github.com
https://github.com/fluent/fluent-plugin-s3/commit/e085aee001d15bcc4bd073507e74075e30550fd0
github.com
https://github.com/fluent/fluent-plugin-s3/releases/tag/v1.8.5
github.com
https://github.com/fluent/fluent-plugin-s3/security/advisories/GHSA-xv9w-7v6q-hpjh
