Vulnerability record · CVE-2017-10906 · published 8 December 2017

CVE-2017-10906: Fluentd vulnerability

Fluentd · Fluentd

Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.

9.8 CVSS 3.0 Critical EPSS 4.6% · top 8.7%

9.8CVSS 3.0 base score, v2 10.0

4.6%EPSS exploitation probability, 30 days

NoNot in CISA KEV

2Affected product versions listed by NVD

8References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Fluentd Fluentd

Openstack Redhat

References

Link	Tags
https://access.redhat.com/errata/RHSA-2018:2225	Third Party Advisory
https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixes	Issue TrackingRelease NotesThird Party Advisory
https://github.com/fluent/fluentd/pull/1733	Issue TrackingPatchThird Party Advisory
https://jvn.jp/en/vu/JVNVU95124098/index.html	Issue TrackingThird Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2018:2225	Third Party Advisory
https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixes	Issue TrackingRelease NotesThird Party Advisory
https://github.com/fluent/fluentd/pull/1733	Issue TrackingPatchThird Party Advisory
https://jvn.jp/en/vu/JVNVU95124098/index.html	Issue TrackingThird Party AdvisoryVDB Entry

Track CVE-2017-10906 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2017-2637Redhat openstack missing authentication for critical function vulnerabilityA design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed…EPSS 4.8%26 Jul 2018 10.0CVE-2015-1842Redhat openstack vulnerabilityThe puppet manifests in the Red Hat openstack-puppet-modules package before 2014.2.13-2 uses a default password of CHANGEME for the pcsd daemon, whic…EPSS 5.2%10 Apr 2015 9.9CVE-2016-9603Qemu heap-based buffer overflow vulnerabilityA heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a V…EPSS 4.4%27 Jul 2018 9.9CVE-2017-2620Qemu out-of-bounds write vulnerabilityQuick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could…EPSS 3.6%27 Jul 2018 9.8CVE-2026-44024Fluentd path traversal vulnerabilityFluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allo…EPSS 1.1%8 Jul 2026 9.8CVE-2022-39379Fluentd unauthenticated RCE via unsafe JSON deserializationFluentd, when the non-default environment variable FLUENT_OJ_OPTION_MODE is set to object, deserializes untrusted JSON payloads unsafely, allowing re…EPSS 45%analysed2 Nov 2022 9.8CVE-2015-5741Golang go http request smuggling vulnerabilityThe net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP r…EPSS 2.7%8 Feb 2020 9.8CVE-2013-2166Openstack python-keystoneclient inadequate encryption strength vulnerabilitypython-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypassEPSS 2.1%10 Dec 2019

Source: NIST National Vulnerability Database (record CVE-2017-10906), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.