Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to version 1.19.3 the in_http and in_forward plugins accept gzip‑compressed payloads but only restrict the size of the compressed data. An attacker can craft a highly compressed payload that, when decompressed in memory, expands to an excessive size, exhausting available memory and causing the Fluentd service to become unresponsive (Denial of Service). The issue was addressed in version 1.19.3, and the weakness is classified as CWE‑409 (Resource Exhaustion through Intentionally Large Input).

The vulnerability affects the Fluentd data collector in all releases prior to 1.19.3. Any configuration that enables the in_http or in_forward plugins and accepts gzip input is susceptible.

The CVSS score of 7.5 indicates significant severity, while the EPSS score of < 1% suggests a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker sending a crafted gzip payload to the HTTP or forward endpoint; the attacker must be able to reach the Fluentd instance over the network.