Executive brief
A vulnerability in the Fluentd S3 plugin, which is used to collect and process logs stored in Amazon S3 buckets, could allow an attacker to crash the logging service. By uploading a specially crafted, highly compressed file to a monitored S3 bucket, an attacker can cause the system to run out of memory during decompression. This results in a service outage, stopping all log collection on the affected server.
Technical details
The `in_s3` input plugin in `fluent-plugin-s3` fails to enforce strict size limits when decompressing files (such as gzip, lzma2, or lzop) retrieved from Amazon S3. The root cause is the allocation of resources without limits (CWE-770), where the plugin attempts to read the entire decompressed payload into memory at once. An attacker with write permissions to the monitored S3 bucket can upload a 'decompression bomb'—a small file that expands to an enormous size—leading to memory exhaustion and an Out-of-Memory (OOM) kill of the Fluentd process. This vulnerability is addressed in version 1.8.5 by introducing a `decompression_size_limit` parameter.
Affected products
- Fluentd fluent-plugin-s3 >= 0.7.0, <= 1.8.4
Timeline
- 2026-06-25: patched: Fix committed to repository
- 2026-06-26: disclosed: GitHub Advisory published