CVE-2021-41186

Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. This issue is patched in version 1.14.2 There are two workarounds available. Either don't use parser_apache2 for parsing logs (which cannot guarantee generated by Apache), or put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable `FLUENT_PLUGIN` or `--plugin` option of fluentd).

• CWE-400

• https://github.com/fluent/fluentd/blob/master/CHANGELOG.md#v1142Release Notes, Third Party Advisory
• https://github.com/fluent/fluentd/security/advisories/GHSA-hwhf-64mh-r662Third Party Advisory
• https://github.com/github/securitylab-vulnerabilities/blob/52dc4a2a828c6dc24231967c2937ad92038184a9/vendor_reports/GHSL-2021-102-fluent-fluentd.mdBroken Link
• https://github.com/fluent/fluentd/blob/master/CHANGELOG.md#v1142Release Notes, Third Party Advisory
• https://github.com/fluent/fluentd/security/advisories/GHSA-hwhf-64mh-r662Third Party Advisory
• https://github.com/github/securitylab-vulnerabilities/blob/52dc4a2a828c6dc24231967c2937ad92038184a9/vendor_reports/GHSL-2021-102-fluent-fluentd.mdBroken Link

Published

Oct 29, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41180Nextcloud talk is a self hosting messaging service. In versi…6.1
• CVE-2021-41181Nextcloud talk is a self hosting messaging service. In versi…2.4
• CVE-2021-41182jQuery-UI is the official jQuery user interface library. Pri…6.1
• CVE-2021-41183jQuery-UI is the official jQuery user interface library. Pri…6.1
• CVE-2021-41184jQuery-UI is the official jQuery user interface library. Pri…6.1
• CVE-2021-41185Mycodo is an environmental monitoring and regulation system.…6.5
• CVE-2021-41187DHIS 2 is an information system for data capture, management…8.8
• CVE-2021-41188Shopware is open source e-commerce software. Versions prior …5.4
• CVE-2021-41189DSpace is an open source turnkey repository application. In …7.2
• CVE-2021-4119bookstack is vulnerable to Improper Access Control9.8
• CVE-2021-41190The OCI Distribution Spec project defines an API protocol to…5
• CVE-2021-41191Roblox-Purchasing-Hub is an open source Roblox product purch…7.5