Four new fluentd advisories

gems/fluentd/GHSA-5hq3-r276-rfr5.yml

@@ -0,0 +1,51 @@
+---
+gem: fluentd
+ghsa: 5hq3-r276-rfr5
+url: https://github.com/fluent/fluentd/security/advisories/GHSA-5hq3-r276-rfr5
+title: Incomplete Fix for CVE-2026-44024 - Path Traversal Bypass
+  via Bare `..` Tag in Output Plugins
+date: 2026-09-28
+description: |
+  Fluentd allows dynamically constructing file paths using the ${tag}
+  placeholder.
+  It was discovered that the previous path traversal mitigation
+  (CVE-2026-44024) introduced in v1.19.3 is incomplete.
+
+  Specifically, the validation logic fails to detect a bare .. (two
+  dots without a trailing separator) when provided as the tag value.
+  When this tag is substituted into a configured path template (e.g.,
+  /path/to/${tag}/output), the surrounding path separators in the
+  template complete the traversal sequence (e.g., /path/to/../output),
+  successfully bypassing the intended directory restrictions.
+  Furthermore, the secondary post-substitution validation is
+  inherently skipped when the buffer is configured to group by
+  tag only (<buffer tag>).
+
+  If a Fluentd instance is configured to receive logs from untrusted
+  sources and uses the ${tag} placeholder in file configurations
+  (such as the path parameter in the out_file plugin), an attacker
+  can exploit this bypass. This vulnerability allows an attacker
+  to write arbitrary files or overwrite existing files on the
+  system with attacker-controlled content.
+
+  ## Impact
+
+  This vulnerability allows for Arbitrary File Write, which can be
+  directly escalated to full Remote Code Execution (RCE).
+  An attacker could achieve RCE by overwriting critical system files
+  (such as cron jobs or SSH keys), injecting executable plugins, or
+  modifying configuration files.
+  The impact is Critical as it can lead to full system compromise
+  without any authentication, depending on the Fluentd configuration
+  and the privileges of the Fluentd process.
+cvss_v3: 7.5
+patched_versions:
+  - ">= 1.19.4"
+related:
+  url:
+    - https://rubygems.org/gems/fluentd/versions/1.19.4
+    - https://github.com/fluent/fluentd/blob/master/CHANGELOG.md#release-v1194---20260928
+    - https://github.com/fluent/fluentd/security/advisories/GHSA-5hq3-r276-rfr5
+notes: |
+  - No CVE from GHSA URL.
+  - cvss_v3 from GHSA URL.

gems/fluentd/GHSA-g69w-f42r-xp35.yml

@@ -0,0 +1,46 @@
+---
+gem: fluentd
+ghsa: g69w-f42r-xp35
+url: https://github.com/fluent/fluentd/security/advisories/GHSA-g69w-f42r-xp35
+title: Out-of-Memory DoS via Object Allocation
+  Amplification in `in_http` ndjson parsing
+date: 2026-09-28
+description: |
+  Fluentd's in_http plugin allows receiving logs via HTTP requests.
+  It was discovered that the parsing logic for ndjson (Newline
+  Delimited JSON) parameters is vulnerable to an object allocation
+  amplification attack, which can lead to a Denial of Service (DoS)
+  due to memory exhaustion (OOM).
+
+  When processing ndjson payloads, the plugin eagerly splits the
+  entire decompressed payload into an array of strings in memory.
+  An attacker can craft a highly compressed HTTP request containing
+  millions of extremely short lines. While the raw decompressed byte
+  size successfully passes the configured decompression_size_limit,
+  the overhead of allocating millions of individual Ruby string
+  objects causes the actual memory consumption to drastically exceed
+  the intended limits. This massive object-count amplification
+  rapidly exhausts system memory, causing the Fluentd worker
+  process to be killed by the operating system.
+
+  ## Impact
+
+  This vulnerability allows for an unauthenticated remote Denial of
+  Service (DoS).
+  By sending crafted, highly compressible payloads to the in_http
+  endpoint, an attacker can continuously crash the Fluentd worker
+  processes. Although the Fluentd supervisor automatically restarts
+  crashed workers, repeated malicious requests can sustain the
+  outage, resulting in dropped logs and severe backpressure to
+  upstream systems.
+cvss_v3: 7.5
+patched_versions:
+  - ">= 1.19.4"
+related:
+  url:
+    - https://rubygems.org/gems/fluentd/versions/1.19.4
+    - https://github.com/fluent/fluentd/blob/master/CHANGELOG.md#release-v1194---20260928
+    - https://github.com/fluent/fluentd/security/advisories/GHSA-g69w-f42r-xp35
+notes: |
+  - No CVE from GHSA URL.
+  - cvss_v3 from GHSA URL.

gems/fluentd/GHSA-h3xv-5jpx-r4j2.yml

@@ -0,0 +1,44 @@
+---
+gem: fluentd
+ghsa: h3xv-5jpx-r4j2
+url: https://github.com/fluent/fluentd/security/advisories/GHSA-h3xv-5jpx-r4j2
+title: Out-of-Memory DoS via Unbounded TCP/TLS Connection
+  Buffer in `in_syslog`
+date: 2026-09-28
+description: |
+  Fluentd's in_syslog plugin allows receiving syslog messages over
+  UDP, TCP, and TLS. It was discovered that the plugin is vulnerable
+  to an unauthenticated remote memory exhaustion (OOM) attack
+  when configured to use TCP or TLS transport.
+
+  While the message_length_limit parameter correctly bounds payload
+  sizes for UDP inputs, the TCP and TLS handlers append incoming
+  data to an unbounded per-connection buffer before parsing. An
+  attacker can exploit this missing validation by establishing a
+  TCP/TLS connection and continuously streaming bytes without
+  sending the configured delimiter (Traditional Framing), or by
+  declaring a massive frame length but never completing the payload
+  (Octet-Count Framing). In both scenarios, Fluentd buffers the
+  incomplete data indefinitely, allowing a single connection to
+  exhaust system memory and crash the worker process.
+
+  ## Impact
+
+  This vulnerability allows for an unauthenticated remote Denial of
+  Service (DoS).
+  By sending crafted, unterminated, or malformed streams to the
+  in_syslog TCP/TLS endpoint, an attacker can rapidly exhaust system
+  memory. This results in the operating system killing the Fluentd
+  worker process (OOM Killer), leading to dropped logs, service
+  outages, and severe backpressure to upstream systems.
+cvss_v3: 7.5
+patched_versions:
+  - ">= 1.19.4"
+related:
+  url:
+    - https://rubygems.org/gems/fluentd/versions/1.19.4
+    - https://github.com/fluent/fluentd/blob/master/CHANGELOG.md#release-v1194---20260928
+    - https://github.com/fluent/fluentd/security/advisories/GHSA-h3xv-5jpx-r4j2
+notes: |
+  - No CVE from GHSA URL.
+  - cvss_v3 from GHSA URL.

gems/fluentd/GHSA-x455-r5cg-h9p9.yml

@@ -0,0 +1,44 @@
+---
+gem: fluentd
+ghsa: x455-r5cg-h9p9
+url: https://github.com/fluent/fluentd/security/advisories/GHSA-x455-r5cg-h9p9
+title: Incomplete Fix for CVE-2026-44160 - DoS via Unbounded
+  Decompression in Buffer Chunk Streaming
+date: 2026-09-28
+description: |
+  Fluentd supports buffer compression (e.g., <compress gzip> or
+  <compress zstd>) to reduce the on-disk footprint of buffered data.
+  It was discovered that the previous mitigation for decompression
+  bombs (CVE-2026-44160) is incomplete.
+
+  While the decompression_size_limit introduced in the previous fix
+  is properly enforced for string-based data reads, the streaming
+  IO decompression path (specifically Buffer::Chunk#open and #write_to)
+  bypasses this limit entirely. If buffer compression is enabled, an
+  attacker can send highly compressible payloads. These payloads
+  bypass buffer chunk limits because they are evaluated based on
+  their tiny compressed size. However, when the chunk is flushed to
+  an output IO (such as a file, socket, or standard output) or
+  triggers the automatic error-backup path (backup_chunk), it
+  expands to an unbounded size without any limitation.
+
+  ## Impact
+
+  This vulnerability allows for an unauthenticated remote Denial of
+  Service (DoS).
+  By injecting highly repetitive, highly compressible data into a
+  Fluentd instance with buffer compression enabled, an attacker can
+  cause massive data amplification during the buffer flush phase.
+  This results in severe memory exhaustion (OOM) or total disk space
+  depletion, crashing the Fluentd worker and disrupting log routing.
+cvss_v3: 2.9
+patched_versions:
+  - ">= 1.19.4"
+related:
+  url:
+    - https://rubygems.org/gems/fluentd/versions/1.19.4
+    - https://github.com/fluent/fluentd/blob/master/CHANGELOG.md#release-v1194---20260928
+    - https://github.com/fluent/fluentd/security/advisories/GHSA-x455-r5cg-h9p9
+notes: |
+  - No CVE from GHSA URL.
+  - cvss_v3 from GHSA URL.