fluent-plugins-nursery fluent-plugin-opentelemetry up to 0.5.2 memory allocation

Summaryinfo

A vulnerability, which was classified as problematic, has been found in fluent-plugins-nursery fluent-plugin-opentelemetry up to 0.5.2. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in memory allocation. This vulnerability is cataloged as CVE-2026-44163. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in fluent-plugins-nursery fluent-plugin-opentelemetry up to 0.5.2. It has been classified as problematic. This affects an unknown functionality. The manipulation with an unknown input leads to a memory allocation vulnerability. CWE is classifying the issue as CWE-789. The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. This is going to have an impact on availability. The summary by CVE is:

fluent-plugin-opentelemetry is a Fluentd input and output plugin for forwarding OpenTelemetry Protocol data. Prior to 0.5.3, the in_opentelemetry HTTP input read the entire incoming request body and decompressed payloads into memory without enforcing maximum size thresholds. When an OpenTelemetry ingestion endpoint was exposed to an untrusted network, an attacker could send an excessively large request or a highly compressed payload that expanded in memory. The resulting memory exhaustion could cause the operating system to terminate the Fluentd process, disrupting all log collection and forwarding on the affected node. This issue is fixed in version 0.5.3.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-44163 since 05/05/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available.

Upgrading to version 0.5.3 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• fluent-plugins-nursery

Name

• fluent-plugin-opentelemetry

Version

• 0.5.0
• 0.5.1
• 0.5.2

Website

• Product: https://github.com/fluent-plugins-nursery/fluent-plugin-opentelemetry/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion