{"id":"CVE-2026-44162","aliases":["GHSA-xv9w-7v6q-hpjh"],"url":"https://o3.security/vulnerability/CVE-2026-44162","summary":"fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in `in_s3`","details":"The `fluent-plugin-s3` plugin (specifically the `in_s3` input plugin) supports reading and decompressing heavily compressed files (such as `gzip`, `lzma2`, and `lzop`) from Amazon S3. \nIt was discovered that the plugin read the entire decompressed payload into memory at once without enforcing a strict size limit.\n\nIf an attacker has sufficient permissions to upload files to the monitored S3 bucket, they can upload a maliciously crafted, highly compressed file.\nWhen Fluentd attempts to decompress this file, it will expand to an excessive size and it will consume significant system resources.\n\n### Impact\nThis vulnerability allows for a **Denial of Service (DoS)** attack via memory exhaustion. \nThe rapid memory consumption during decompression can lead to an Out-of-Memory kill of the Fluentd process by the operating system, \nThis results in the disruption of all log collection on the affected node.\n\n### Patches\nv1.8.5\n\n### Workarounds\nIf an immediate upgrade is not possible, mitigate the risk by applying strict IAM access controls:\n\n1. Restrict Bucket Access\n   * Ensure that write (PUT) access to the S3 bucket monitored by `in_s3` is strictly limited to trusted services and administrators. Prevent any public or untrusted uploads to the S3 bucket.","published":"2026-09-14T17:45:37.057Z","modified":"2026-09-16T03:45:59.729928278Z","cvss":{"score":2.7,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"},"epss":{"score":0.00354,"percentile":0.28993,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"RubyGems","name":"fluent-plugin-s3","fixedVersion":"1.8.5"}],"fix":{"url":"https://github.com/fluent/fluent-plugin-s3/commit/e085aee001d15bcc4bd073507e74075e30550fd0","label":"fluent/fluent-plugin-s3@e085aee"},"references":[{"type":"WEB","url":"https://github.com/fluent/fluent-plugin-s3/releases/tag/v1.8.5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44162.json"},{"type":"ADVISORY","url":"https://github.com/fluent/fluent-plugin-s3/security/advisories/GHSA-xv9w-7v6q-hpjh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44162"},{"type":"FIX","url":"https://github.com/fluent/fluent-plugin-s3/commit/e085aee001d15bcc4bd073507e74075e30550fd0"},{"type":"PACKAGE","url":"https://github.com/fluent/fluent-plugin-s3"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-16T03:45:59.729928278Z"}}