CVE-2026-44162: fluent-plugin-s3 Memory Exhaustion DoS Vulnerability

CVE-2026-44162 Overview

CVE-2026-44162 is a resource exhaustion vulnerability in fluent-plugin-s3, the Amazon S3 input and output plugin for Fluentd. Versions 0.7.0 through 1.8.4 are affected. The in_s3 input plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompression_size_limit. An attacker with permission to upload objects to a monitored S3 bucket can stage a highly compressed object that expands excessively during processing. The resulting memory pressure can cause the operating system to terminate the Fluentd process and disrupt log collection on the affected node. The issue is fixed in version 1.8.5 and is categorized as improper handling of highly compressed data [CWE-409].

Critical Impact
A single crafted S3 object can exhaust host memory and terminate Fluentd, halting log collection across the affected node.

Affected Products

fluent-plugin-s3 0.7.0 through 1.8.4
Fluentd deployments using the in_s3 input plugin
Any environment ingesting gzip, lzma2, or lzop compressed S3 objects via this plugin

Discovery Timeline

2026-09-14 - CVE-2026-44162 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-44162

Vulnerability Analysis

The in_s3 input plugin fetches objects from a configured S3 bucket and decompresses them before parsing. Prior to version 1.8.5, the plugin invoked its gzip, lzma2, and lzop extractors without any cap on the decompressed output size. The extractor code paths read the full decompressed stream into memory using patterns such as Zlib::GzipReader.wrap(io) { |gz| gz.read }. A modestly sized compressed object can expand to gigabytes of memory when the compression ratio is high. This is a classic decompression bomb pattern, and Fluentd offered no bounded-read primitive to protect the worker process.

Root Cause

The root cause is missing enforcement of a decompression size limit in the S3 extractor implementations. Extractors deferred to external commands (gzip, lzop, xz) or Ruby standard-library readers and consumed all output without tracking bytes written. Because Fluentd processes typically run with generous or unbounded memory allocations to buffer log batches, the operating system out-of-memory killer terminates the worker before the plugin surfaces a controlled error.

Attack Vector

Exploitation requires an attacker principal that can PutObject into the monitored S3 bucket. The attacker uploads a small archive containing highly redundant data, for example a multi-gigabyte stream of null bytes compressed with gzip -9. When the in_s3 plugin polls the bucket and processes the object, the extractor expands the payload into RAM. The host kernel terminates the Fluentd process, breaking log pipelines and eliminating downstream visibility for other events on the node.

ruby

// Patch: introduces DECOMPRESSION_SIZE_LIMIT and a configurable decompression_size_limit
    end

    DEFAULT_PARSE_TYPE = "none"
+    DECOMPRESSION_SIZE_LIMIT = 256 * 1024 * 1024

    desc "Use aws-sdk-ruby bundled cert"
    config_param :use_bundled_cert, :bool, default: false
    desc "Add object metadata to the records parsed out of a given object"
    config_param :add_object_metadata, :bool, default: false
+    desc 'The size limit of the extracted element.'
+    config_param :decompression_size_limit, :size, default: DECOMPRESSION_SIZE_LIMIT

Source: GitHub Commit e085aee

The gzip extractor was refactored to route through a shared extract_with_command helper that raises SizeLimitError when the configured cap is exceeded:

ruby

      def extract(io)
+        begin
+          extract_with_command("gzip #{@command_parameter}", io, "gzip-temp")
+        rescue SizeLimitError
+          raise
+        rescue => e
+          log.warn "gzip command execution failed: #{e.message}. Fallback to GzipExtractor."
+          io.rewind

Source: GitHub Commit e085aee

Detection Methods for CVE-2026-44162

Indicators of Compromise

Fluentd worker processes terminated by the Linux out-of-memory killer, visible in dmesg or journalctl -k as Killed process ... fluentd.
Sudden gaps in log ingestion from nodes running the in_s3 input plugin, correlated with recent S3 PutObject events.
S3 objects with unusually high compression ratios, for example small files whose reported uncompressed size exceeds several hundred megabytes.

Detection Strategies

Enumerate hosts running fluent-plugin-s3 at versions 0.7.0 through 1.8.4 via package inventory or fluent-gem list fluent-plugin-s3.
Correlate CloudTrail PutObject events on monitored buckets with subsequent Fluentd worker restarts.
Alert when Fluentd resident memory grows sharply within a short window after an S3 object is fetched.

Monitoring Recommendations

Emit metrics for Fluentd process restart counts and OOM kills, and route them to your SIEM.
Track S3 bucket writers and flag principals outside expected log producers.
Sample compressed object sizes and inspect any object whose declared or observed expansion ratio exceeds a set threshold.

How to Mitigate CVE-2026-44162

Immediate Actions Required

Upgrade fluent-plugin-s3 to version 1.8.5 or later on all Fluentd nodes.
Restrict s3:PutObject on monitored buckets to trusted log producers and remove broad write grants.
Review IAM policies and bucket policies for cross-account or public write access to buckets consumed by in_s3.

Patch Information

The fix is delivered in fluent-plugin-s31.8.5. The patch introduces a new configuration parameter decompression_size_limit with a default of 256 * 1024 * 1024 bytes (256 MB) and raises a SizeLimitError when the limit is exceeded during extraction. See the GitHub Security Advisory GHSA-xv9w-7v6q-hpjh and the v1.8.5 release notes for full details.

Workarounds

Apply cgroup or systemd memory limits to the Fluentd service so that a single worker cannot exhaust host memory, then let the process supervisor restart it.
Tighten S3 bucket write permissions using least-privilege IAM policies and remove any wildcard Principal grants.
If upgrade is not immediately possible, disable ingestion of compressed object types (gzip, lzma2, lzop) from untrusted sources by filtering objects before they land in the monitored bucket.

bash

# After upgrading to 1.8.5, set an explicit decompression size limit in the in_s3 source
<source>
  @type s3
  s3_bucket my-log-bucket
  region us-east-1
  store_as gzip
  decompression_size_limit 268435456  # 256 MB cap; adjust to expected payload size
  <parse>
    @type json
  </parse>
</source>