CVE-2026-44163: Fluentd OpenTelemetry Plugin DOS Vulnerability

CVE-2026-44163 Overview

CVE-2026-44163 is a resource exhaustion vulnerability [CWE-409] in fluent-plugin-opentelemetry, a Fluentd input and output plugin for forwarding OpenTelemetry Protocol (OTLP) data. Versions prior to 0.5.3 allow the in_opentelemetry HTTP input to read entire request bodies and decompress payloads into memory without enforcing size limits. An attacker with network access to the ingestion endpoint can submit an oversized request or a highly compressed payload that expands in memory. The resulting memory pressure can trigger the operating system to terminate the Fluentd process, disrupting log collection and forwarding on the affected node. The issue is fixed in version 0.5.3.

Critical Impact
A single crafted HTTP request can exhaust Fluentd process memory and halt telemetry ingestion on the affected node.

Affected Products

fluent-plugin-opentelemetry versions prior to 0.5.3
Fluentd deployments exposing the in_opentelemetry HTTP input to untrusted networks
OpenTelemetry ingestion pipelines relying on the affected plugin

Discovery Timeline

2026-09-15 - CVE-2026-44163 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-44163

Vulnerability Analysis

The in_opentelemetry HTTP handler processes incoming OTLP payloads by buffering the full request body and decompressing supported encodings before parsing. The pre-patch implementation did not enforce a maximum body size or a maximum decompressed size. Attackers can exploit this in two ways. First, they can submit a very large raw request body that Fluentd loads entirely into memory. Second, they can submit a small, highly compressed payload (a compression bomb) that expands to hundreds of megabytes or more after decompression. Both approaches drive the Fluentd Ruby process toward memory exhaustion, at which point the Linux out-of-memory (OOM) killer typically terminates it. Once the process is killed, all Fluentd-mediated log collection and forwarding on that node stops until the service restarts.

Root Cause

The root cause is missing input size validation in the HTTP input handler defined in lib/fluent/plugin/opentelemetry/http_input_handler.rb and the in_opentelemetry plugin. Neither the raw request body length nor the decompressed payload length was constrained, mapping directly to CWE-409 (Improper Handling of Highly Compressed Data).

Attack Vector

Exploitation requires network reachability to the OTLP HTTP endpoint (default port 4318) and no authentication or user interaction. Any client capable of issuing an HTTP POST to the ingestion endpoint can trigger the condition.

ruby

# Patch: lib/fluent/plugin/in_opentelemetry.rb
      config_param :bind, :string, default: "0.0.0.0"
      desc "The port to listen to."
      config_param :port, :integer, default: 4318
+
+      desc "The size limit of the POSTed element. This value should be larger than the 'chunk_limit_size' in out_opentelemetry plugin."
+      config_param :body_size_limit, :size, default: 32 * 1024 * 1024
+      desc "The size limit of the decompressed element."
+      config_param :decompression_size_limit, :size, default: 256 * 1024 * 1024
    end

    config_section :grpc, required: false, multi: false, init: false, param_name: :grpc_config do
# Source: https://github.com/fluent-plugins-nursery/fluent-plugin-opentelemetry/commit/ce6c1f2a7741592c8a79afbe75fded9e8ebfa92d

The patch introduces two configurable limits: body_size_limit (default 32 MiB) and decompression_size_limit (default 256 MiB). The HTTP input handler enforces them and raises a new SizeLimitError when a request exceeds either threshold.

ruby

# Patch: lib/fluent/plugin/opentelemetry/http_input_handler.rb
          @request.body&.close
        end
      end
+
+      unless method_defined?(:body_stream)
+        def body_stream
+          @request.body
+        end
+      end
    end
  end
end

class Fluent::Plugin::Opentelemetry::HttpInputHandler
+  class SizeLimitError < StandardError; end
+
  using Fluent::PluginHelper::HttpServer::Extension

  def initialize(http_config, logger)
# Source: https://github.com/fluent-plugins-nursery/fluent-plugin-opentelemetry/commit/ce6c1f2a7741592c8a79afbe75fded9e8ebfa92d

Detection Methods for CVE-2026-44163

Indicators of Compromise

Fluentd process termination events in system logs, particularly OOM killer messages referencing the ruby or fluentd process
Sudden gaps in log ingestion or forwarding from nodes running the in_opentelemetry input
HTTP POST requests to port 4318 with Content-Length values exceeding expected OTLP batch sizes
Requests with Content-Encoding: gzip where the decompressed size is disproportionately larger than the transmitted size

Detection Strategies

Inspect reverse proxy or ingress logs in front of Fluentd for anomalously large payloads targeting the OTLP HTTP endpoint
Alert on repeated Fluentd process restarts or crash loops on nodes that expose in_opentelemetry
Correlate memory utilization spikes on Fluentd hosts with inbound requests to port 4318

Monitoring Recommendations

Track Fluentd resident memory (RSS) and set thresholds that trigger alerts before OOM termination
Monitor kernel: Out of memory: Killed process entries in dmesg and forward them to a central log store
Emit metrics for HTTP request sizes and compression ratios at the ingress layer

How to Mitigate CVE-2026-44163

Immediate Actions Required

Upgrade fluent-plugin-opentelemetry to version 0.5.3 or later on all Fluentd nodes
Restrict network exposure of the OTLP HTTP endpoint (port 4318) to trusted collectors and internal networks
Place an authenticated reverse proxy or ingress controller with request size limits in front of Fluentd if direct exposure cannot be avoided

Patch Information

The fix is delivered in fluent-plugin-opentelemetry version 0.5.3. It adds the body_size_limit (default 32 MiB) and decompression_size_limit (default 256 MiB) parameters to the in_opentelemetry HTTP input, and enforces both limits during request handling via a new SizeLimitError exception. See the GitHub Security Advisory GHSA-2jc5-xhx8-qj6h and the upstream commit for implementation details.

Workarounds

Enforce request size limits at an upstream reverse proxy (for example, client_max_body_size in NGINX) to reject oversized OTLP payloads before they reach Fluentd
Apply network access controls so only trusted OpenTelemetry collectors can reach the in_opentelemetry endpoint
Configure per-process memory limits (for example, systemd MemoryMax or Kubernetes resource limits) so a single crash is contained and the service is automatically restarted

bash

# Example NGINX configuration in front of Fluentd OTLP HTTP endpoint
server {
    listen 443 ssl;
    server_name otlp.example.internal;

    # Reject oversized payloads before they reach Fluentd
    client_max_body_size 32m;

    location /v1/logs {
        proxy_pass http://127.0.0.1:4318;
        proxy_set_header Host $host;
    }
}

# Example in_opentelemetry configuration on version 0.5.3+
# <source>
#   @type opentelemetry
#   <http>
#     bind 0.0.0.0
#     port 4318
#     body_size_limit 32m
#     decompression_size_limit 256m
#   </http>
# </source>