Executive brief
A vulnerability in the OpenTelemetry plugin for Fluentd allows an attacker to crash the logging service. By sending a specially crafted, highly compressed data packet, an attacker can force the system to exhaust its memory during decompression. This results in a total disruption of log collection and forwarding across the affected network node.
Technical details
The fluent-plugin-opentelemetry plugin, specifically the 'in_opentelemetry' HTTP input, fails to enforce strict size limits on incoming request bodies. The component reads the entire request into memory and performs decompression without verifying maximum size thresholds, making it susceptible to decompression bombs (zip bombs). An unauthenticated remote attacker can exploit this by sending a large or highly compressed payload to the ingestion port (default 4318), triggering an Out-of-Memory (OOM) kill of the Fluentd process. This vulnerability is addressed in version 0.5.3 by implementing size limits.
Affected products
- Fluentd fluent-plugin-opentelemetry <= 0.5.2
Timeline
- 2026-06-25: patched: Fix committed to repository
- 2026-06-26: disclosed: GitHub Advisory published
References
- https://github.com/fluent-plugins-nursery/fluent-plugin-opentelemetry/security/advisories/GHSA-2jc5-xhx8-qj6h
- https://github.com/fluent-plugins-nursery/fluent-plugin-opentelemetry/commit/ce6c1f2a7741592c8a79afbe75fded9e8ebfa92d
- https://api.github.com/repos/fluent-plugins-nursery/fluent-plugin-opentelemetry/security-advisories/GHSA-2jc5-xhx8-qj6h