VulnerableCode Package Details - pkg:gem/fluentd@1.14.0

Search for packages

Vulnerability	Summary	Fixed by
VCID-8hsx-rzd7-gqe2 Aliases: CVE-2022-39379 GHSA-fppq-mj76-fpj2	fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration) ### Impact A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. ### Patches v1.15.3 ### Workarounds Do not use `FLUENT_OJ_OPTION_MODE=object`. ### References * GHSL-2022-067	1.15.3 Affected by 0 other vulnerabilities.
VCID-ar2a-d6fd-q3e5 Aliases: CVE-2021-41186 GHSA-hwhf-64mh-r662	Uncontrolled Resource Consumption Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The `parser_apache2` plugin in Fluentd suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. There are two workarounds available. Either don't use `parser_apache2` for parsing logs (which cannot guarantee generated by Apache), or put patched version of `parser_apache2.rb` into `/etc/fluent/plugin` directory (or any other directories specified by the environment variable `FLUENT_PLUGIN` or `--plugin` option of fluentd).	1.14.2 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-8hsx-rzd7-gqe2
Aliases:
CVE-2022-39379
GHSA-fppq-mj76-fpj2

fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration) ### Impact A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. ### Patches v1.15.3 ### Workarounds Do not use `FLUENT_OJ_OPTION_MODE=object`. ### References * GHSL-2022-067

1.15.3
Affected by 0 other vulnerabilities.

VCID-ar2a-d6fd-q3e5
Aliases:
CVE-2021-41186
GHSA-hwhf-64mh-r662

Uncontrolled Resource Consumption Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The `parser_apache2` plugin in Fluentd suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. There are two workarounds available. Either don't use `parser_apache2` for parsing logs (which cannot guarantee generated by Apache), or put patched version of `parser_apache2.rb` into `/etc/fluent/plugin` directory (or any other directories specified by the environment variable `FLUENT_PLUGIN` or `--plugin` option of fluentd).

1.14.2
Affected by 2 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-06T03:09:09.351009+00:00	GitLab Importer	Affected by	VCID-8hsx-rzd7-gqe2	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/fluentd/CVE-2022-39379.yml	38.6.0
2026-06-06T01:04:26.056393+00:00	GitLab Importer	Affected by	VCID-ar2a-d6fd-q3e5	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/fluentd/CVE-2021-41186.yml	38.6.0
2026-06-04T18:12:34.518461+00:00	Ruby Importer	Affected by	VCID-ar2a-d6fd-q3e5	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/fluentd/CVE-2021-41186.yml	38.6.0