CVE-2022-39379

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.

• CWE-502
• CWE-502

• https://github.com/fluent/fluentd/commit/48e5b85dab1b6d4c273090d538fc11b3f2fd8135Patch, Third Party Advisory
• https://github.com/fluent/fluentd/security/advisories/GHSA-fppq-mj76-fpj2Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MYD5QV66OLDHES6IKVYYM3Y3YID3VVCO/
• https://github.com/fluent/fluentd/commit/48e5b85dab1b6d4c273090d538fc11b3f2fd8135Patch, Third Party Advisory
• https://github.com/fluent/fluentd/security/advisories/GHSA-fppq-mj76-fpj2Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MYD5QV66OLDHES6IKVYYM3Y3YID3VVCO/

Published

Nov 2, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39373GLPI stands for Gestionnaire Libre de Parc Informatique. GLP…4.8
• CVE-2022-39374Synapse is an open-source Matrix homeserver written and main…6.5
• CVE-2022-39375GLPI stands for Gestionnaire Libre de Parc Informatique. GLP…5.4
• CVE-2022-39376GLPI stands for Gestionnaire Libre de Parc Informatique. GLP…6.5
• CVE-2022-39377sysstat is a set of system performance tools for the Linux o…7.8
• CVE-2022-39378Discourse is a platform for community discussion. Under cert…5.3
• CVE-2022-3938Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-39380Wire web-app is part of Wire communications. Versions prior …5.3
• CVE-2022-39381Muhammara is a node module with c/cpp bindings to modify PDF…5.5
• CVE-2022-39382Keystone is a headless CMS for Node.js — built with GraphQL …9.8
• CVE-2022-39383KubeVela is an open source application delivery platform. Us…6.5
• CVE-2022-39384OpenZeppelin Contracts is a library for secure smart contrac…5.6