Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-44163— fluent-plugin-opentelemetry: Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry`

Quick assessment

Affected
fluent-plugins-nursery fluent-plugin-opentelemetry
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

是一个用于转发 OpenTelemetry 协议数据的 Fluentd 输入和输出插件。在 0.5.3 版本之前， HTTP 输入端口会读取整个传入的请求体，并将压缩后的负载解压到内存中，且未强制设置最大尺寸阈值。当 OpenTelemetry 数据接收端点暴露在不信任的网络环境中时，攻击者可以发送一个过大的请求或高度压缩的负载，该负载在解压后会在内存中大幅膨胀。由此导致的内存耗尽可能会触发操作系统终止 Fluentd 进程，从而中断受影响节点上的所有日志收集和转发功能。该问题已在 0.5.3 版本中修复。

CVSS 5.3 · Medium EPSS 0.34% · P27

Possible ATT&CK Techniques 1 AI

T1499.001 · OS Exhaustion Flood

Affected Version Matrix 1

VendorProduct Version RangeStatus
fluent-plugins-nursery fluent-plugin-opentelemetry < 0.5.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-44163

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
fluent-plugin-opentelemetry: Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry`
Source: CVE Program / CVE List V5
Vulnerability Description
fluent-plugin-opentelemetry is a Fluentd input and output plugin for forwarding OpenTelemetry Protocol data. Prior to 0.5.3, the in_opentelemetry HTTP input read the entire incoming request body and decompressed payloads into memory without enforcing maximum size thresholds. When an OpenTelemetry ingestion endpoint was exposed to an untrusted network, an attacker could send an excessively large request or a highly compressed payload that expanded in memory. The resulting memory exhaustion could cause the operating system to terminate the Fluentd process, disrupting all log collection and forwarding on the affected node. This issue is fixed in version 0.5.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对高度压缩数据的处理不恰当(数据放大攻击)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
fluent-plugins-nursery fluent-plugin-opentelemetry < 0.5.3 -

II. Public POCs for CVE-2026-44163

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-44163

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-44163 (1)

Vendor Advisories for CVE-2026-44163 (1)

IV. Related Vulnerabilities

Same weakness: CWE-409

V. Comments for CVE-2026-44163

No comments yet

Leave a comment