Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to version 1.19.3, its in_http and in_forward plugins support gzip‑compresseds through settings such as body_size_limit and chunk_size_limit, allowing crafted compressed payloads to decompress in memory to an excessive size and cause denial of service through memory exhaustion. The flaw does not compromise confidentiality or integrity and was fixed in Fluentd 1.19.3.

The vulnerability affects the Fluentd data collector (fluent all releases prior to version 1.19.3. Any configuration that enables the in_http or in_forward plugins and accepts gzip input is susceptible.

The CVSS score of 7.5 indicates significant severity, while the EPSS score of < 1 % suggests a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker sending a crafted gzip payload to the HTTP or forward endpoint; the attacker must be able to reach the Fluentd instance over the network.