Skip to content

Commit baa4602

Browse files
simiRubySec CI
simi
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@8ad79ee 
1 parent 57f53c0 commit baa4602

4 files changed

Lines changed: 182 additions & 0 deletions

File tree

‎advisories/_posts/2026-06-26-CVE-2026-44024.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-44024 (fluentd): Fluentd is Vulnerable to Remote Code Execution (RCE)
4+
via Arbitrary File Write in `${tag}` Placeholder'
5+
comments: false
6+
categories:
7+
- fluentd
8+
advisory:
9+
gem: fluentd
10+
cve: 2026-44024
11+
ghsa: 44hj-4m45-frj3
12+
url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-44024
13+
title: Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write
14+
in `${tag}` Placeholder
15+
date: 2026-06-26
16+
description: |-
17+
Fluentd allows dynamically constructing file paths using the `${tag}`
18+
placeholder. It was discovered that validation for this placeholder
19+
was insufficient.
20+
21+
If a Fluentd instance is configured to receive logs from untrusted
22+
sources and uses the `${tag}` placeholder in file configurations
23+
(such as the `path` parameter in the `out_file` plugin), an attacker
24+
can inject path traversal characters (e.g., `../`).
25+
26+
When combined with certain formatting options, this vulnerability allows
27+
an attacker to write arbitrary files or overwrite existing files on
28+
the system with attacker-controlled content, bypassing intended
29+
directory restrictions.
30+
31+
### Impact
32+
33+
This vulnerability allows for **Arbitrary File Write**, which can be
34+
directly escalated to full **Remote Code Execution (RCE)**.
35+
An attacker could achieve RCE by overwriting critical system files,
36+
injecting executable plugins, or modifying configuration files.
37+
The impact is Critical as it can lead to full system compromise without
38+
any authentication, depending on the Fluentd configuration and the
39+
privileges of the Fluentd process.
40+
cvss_v3: 9.8
41+
patched_versions:
42+
- ">= 1.19.3"
43+
related:
44+
url:
45+
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-44024
46+
- https://github.com/fluent/fluentd/releases/tag/v1.19.3
47+
- https://github.com/advisories/GHSA-44hj-4m45-frj3
48+
- https://github.com/fluent/fluentd/security/advisories/GHSA-44hj-4m45-frj3
49+
notes: "- CVE is reserved, but not published so no non-GHSA cvss values.\n"
50+
---

‎advisories/_posts/2026-06-26-CVE-2026-44025.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-44025 (fluentd): Fluentd is Vulnerable to Exposure of Sensitive Information
4+
via Monitor Agent API'
5+
comments: false
6+
categories:
7+
- fluentd
8+
advisory:
9+
gem: fluentd
10+
cve: 2026-44025
11+
ghsa: pr7j-96cj-549h
12+
url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-44025
13+
title: Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent
14+
API
15+
date: 2026-06-26
16+
description: |-
17+
Fluentd's Monitor Agent plugin (`in_monitor_agent`) exposes internal
18+
metrics and plugin information via a REST API.
19+
It was discovered that the API response (`/api/plugins.json` and
20+
related endpoints) unintentionally includes internal instance
21+
variables of loaded plugins.
22+
23+
If any plugins store sensitive information—such as database passwords,
24+
API keys, or cloud credentials—in its instance variables, this
25+
information may be exposed in plain text to any user or system
26+
that has HTTP access to the Monitor Agent API.
27+
28+
### Impact
29+
30+
This vulnerability allows for unauthorized information disclosure. An
31+
attacker who can reach the Monitor Agent API port (default: `24220`)
32+
can potentially extract sensitive credentials used by other Fluentd plugins.
33+
The impact severity depends highly on the network configuration (whether
34+
the Monitor Agent port is exposed to untrusted networks) and the
35+
specific plugins configured in the Fluentd instance.
36+
cvss_v3: 7.5
37+
patched_versions:
38+
- ">= 1.19.3"
39+
related:
40+
url:
41+
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-44025
42+
- https://github.com/fluent/fluentd/releases/tag/v1.19.3
43+
- https://github.com/advisories/GHSA-pr7j-96cj-549h
44+
- https://github.com/fluent/fluentd/security/advisories/GHSA-pr7j-96cj-549h
45+
notes: "- CVE is reserved, but not published so no non-GHSA cvss values.\n"
46+
---

‎advisories/_posts/2026-06-26-CVE-2026-44160.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-44160 (fluentd): Fluentd is Vulnerable to Denial of Service (DoS)
4+
via Gzip Decompression Bomb in `in_http` and `in_forward`'
5+
comments: false
6+
categories:
7+
- fluentd
8+
advisory:
9+
gem: fluentd
10+
cve: 2026-44160
11+
ghsa: j9cw-hwqf-85w7
12+
url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-44160
13+
title: Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb
14+
in `in_http` and `in_forward`
15+
date: 2026-06-26
16+
description: |-
17+
Fluentd's `in_http` and `in_forward` plugins support receiving
18+
gzip-compressed data.
19+
20+
While Fluentd correctly enforces size limits on the incoming
21+
compressed payloads (e.g., via `body_size_limit` or `chunk_size_limit`),
22+
it was discovered that there is no limit enforced on the size of the
23+
decompressed data. If a Fluentd instance is exposed to untrusted
24+
networks, an attacker can send a maliciously crafted, highly
25+
compressed payload. When Fluentd attempts to decompress this payload
26+
in memory, it will expand to an excessive size, completely bypassing
27+
the intended payload size limits.
28+
29+
### Impact
30+
31+
This vulnerability allows for a **Denial of Service (DoS)** attack
32+
via memory exhaustion. The rapid memory consumption during decompression
33+
can easily lead to an Out-of-Memory kill of the Fluentd process by
34+
the operating system. This results in the disruption of all log
35+
collection and forwarding capabilities on the affected node.
36+
cvss_v3: 7.5
37+
patched_versions:
38+
- ">= 1.19.3"
39+
related:
40+
url:
41+
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-44160
42+
- https://github.com/fluent/fluentd/releases/tag/v1.19.3
43+
- https://github.com/advisories/GHSA-j9cw-hwqf-85w7
44+
- https://github.com/fluent/fluentd/security/advisories/GHSA-j9cw-hwqf-85w7
45+
notes: "- CVE is reserved, but not published so no non-GHSA cvss values.\n"
46+
---

‎advisories/_posts/2026-06-26-CVE-2026-44161.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-44161 (fluentd): Fluentd is Vulnerable to Server-Side Request Forgery
4+
(SSRF) via Placeholder Expansion in `out_http`'
5+
comments: false
6+
categories:
7+
- fluentd
8+
advisory:
9+
gem: fluentd
10+
cve: 2026-44161
11+
ghsa: 72f5-rr8c-r6gr
12+
url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-44161
13+
title: Fluentd is Vulnerable to Server-Side Request Forgery (SSRF) via Placeholder
14+
Expansion in `out_http`
15+
date: 2026-06-26
16+
description: |-
17+
The `out_http` output plugin allows the use of placeholders (such as
18+
`${tag}`) in the `endpoint` configuration parameter. It was discovered
19+
that if the placeholder value is derived from untrusted user input,
20+
an attacker can maliciously control the destination hostname of the
21+
outbound HTTP requests made by Fluentd.
22+
23+
## Impact
24+
25+
This vulnerability allows for a **Server-Side Request Forgery (SSRF)**
26+
attack. An unauthenticated attacker can force the Fluentd node to send
27+
HTTP requests to arbitrary internal services. This can lead to
28+
unauthorized access to internal APIs, data exfiltration, or the
29+
compromise of cloud metadata endpoints (e.g., AWS IMDS `169.254.169.254`).
30+
cvss_v3: 7.2
31+
patched_versions:
32+
- ">= 1.19.3"
33+
related:
34+
url:
35+
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-44161
36+
- https://github.com/fluent/fluentd/releases/tag/v1.19.3
37+
- https://github.com/advisories/GHSA-72f5-rr8c-r6gr
38+
- https://github.com/fluent/fluentd/security/advisories/GHSA-72f5-rr8c-r6gr
39+
notes: "- CVE is reserved, but not published so no non-GHSA cvss values.\n"
40+
---

0 commit comments

Comments
 (0)