← Vulnerability feed

Vulnerability record · CVE-2021-41186 · published 29 October 2021

CVE-2021-41186: Fluentd uncontrolled resource consumption vulnerability

Fluentd · Fluentd

Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. This issue is patched in version 1.14.2 There are two workarounds available. Either don't use parser_apache2 for parsing logs (which cannot guarantee generated by Apache), or put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable `FLUENT_PLUGIN` or `--plugin` option of fluentd).

7.5 CVSS 3.1 High EPSS 2.2% · top 18.1% CWE-400 · Uncontrolled resource consumption
7.5CVSS 3.1 base score, v2 5.0
2.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. This issue is patched in version 1.14.2 There are two workarounds available. Either don't use parser_apache2 for parsing logs (which cannot guarantee generated by Apache), or put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable `FLUENT_PLUGIN` or `--plugin` option of fluentd).

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/fluent/fluentd/blob/master/CHANGELOG.md#v1142 Release NotesThird Party Advisory
https://github.com/fluent/fluentd/security/advisories/GHSA-hwhf-64mh-r662 Third Party Advisory
https://github.com/github/securitylab-vulnerabilities/blob/52dc4a2a828c6dc24231967c2937ad92038184a9/vendor_reports/GHSL- Broken Link
https://github.com/fluent/fluentd/blob/master/CHANGELOG.md#v1142 Release NotesThird Party Advisory
https://github.com/fluent/fluentd/security/advisories/GHSA-hwhf-64mh-r662 Third Party Advisory
https://github.com/github/securitylab-vulnerabilities/blob/52dc4a2a828c6dc24231967c2937ad92038184a9/vendor_reports/GHSL- Broken Link

Track CVE-2021-41186 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-44024Fluentd path traversal vulnerabilityFluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allo…EPSS 1.1%9.8CVE-2022-39379Fluentd unauthenticated RCE via unsafe JSON deserializationFluentd, when the non-default environment variable FLUENT_OJ_OPTION_MODE is set to object, deserializes untrusted JSON payloads unsafely, allowing re…EPSS 45%analysed9.8CVE-2017-10906Fluentd vulnerabilityEscape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitr…EPSS 4.6%8.8CVE-2020-21514Fluentd incorrect default permissions vulnerabilityAn issue was discovered in Fluent-ui v.1.2.2 allows attackers to gain escalated privileges and execute arbitrary code due to a default password.EPSS 0.79%7.5CVE-2026-44025Fluentd missing authentication for critical function vulnerabilityFluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's Mo…EPSS 0.47%7.5CVE-2026-44160Fluentd vulnerabilityFluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's in…EPSS 0.62%7.2CVE-2026-44161Fluentd server-side request forgery (ssrf) vulnerabilityFluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd …EPSS 0.44%7.5CVE-2026-28318SolarWinds Serv-U unauthenticated POST request denial of serviceSolarWinds Serv-U crashes when it receives a specially crafted POST request using Content-Encoding: deflate, and the crash occurs without authenticat…KEVEPSS 1.9%analysed

Source: NIST National Vulnerability Database (record CVE-2021-41186), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.