CVE-2026-44163

fluent-plugin-opentelemetry is a Fluentd input and output plugin for forwarding OpenTelemetry Protocol data. Prior to 0.5.3, the in_opentelemetry HTTP input read the entire incoming request body and decompressed payloads into memory without enforcing maximum size thresholds. When an OpenTelemetry ingestion endpoint was exposed to an untrusted network, an attacker could send an excessively large request or a highly compressed payload that expanded in memory. The resulting memory exhaustion could cause the operating system to terminate the Fluentd process, disrupting all log collection and forwarding on the affected node. This issue is fixed in version 0.5.3.

• CWE-409

• https://github.com/fluent-plugins-nursery/fluent-plugin-opentelemetry/commit/ce6c1f2a7741592c8a79afbe75fded9e8ebfa92d
• https://github.com/fluent-plugins-nursery/fluent-plugin-opentelemetry/security/advisories/GHSA-2jc5-xhx8-qj6h

Published

Sep 15, 2026

Last Modified

Sep 16, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4415Gigabyte Control Center developed by GIGABYTE has an Arbitra…9.8
• CVE-2026-44159Tyler Identity Local (TID-L) uses documented, default admini…9.8
• CVE-2026-4416The Performance Library component of Gigabyte Control Center…8.5
• CVE-2026-44160Fluentd collects events from various data sources and writes…7.5
• CVE-2026-44161Fluentd collects events from various data sources and writes…7.2
• CVE-2026-44162fluent-plugin-s3 is an Amazon S3 input and output plugin for…2.7
• CVE-2026-44166Pocketbase is an open source web backend written in go. Prio…7.6
• CVE-2026-44167phpseclib is a PHP secure communications library. Prior to 1…7.5
• CVE-2026-44168MariaDB server is a community developed fork of MySQL server…8
• CVE-2026-44169MariaDB server is a community developed fork of MySQL server…4.3
• CVE-2026-44170MariaDB server is a community developed fork of MySQL server…9.8
• CVE-2026-44171MariaDB server is a community developed fork of MySQL server…7.8