Fluentd v1.19.3 Security Update: Strict Host Header Validation and Buffer Limits

Vulnerability Overview In Fluentd v1.19.3, several security-related fixes were introduced, primarily focusing on input data validation and processing. Affected Components out_http: Strict host header validation for dynamic endpoints. buffer, in_http: Size limits for decompressed payloads. in_monitor_agent: Default visibility of configuration, retry, and debug information. output: Strict path boundary validation for tags. engine: Removal of duplicate words in error messages for non-overridable plugins. storage_local: Encoding errors when reading non-ASCII characters. parser_csv: Skipping empty lines or unparseable rows. out_forward: Reuse of closed keep-alive sockets after remote disconnection. buffer: Correct buffer recovery even when paths contain . in_debug_agent: Default restriction to accept requests only from the local host. Remediation #5394: Added strict host header validation for dynamic endpoints. #5393: Enforced size limits on decompressed payloads. #5392: Changed the default visibility of configuration, retry, and debug information in . #5391: Enforced strict path boundary validation for tags. #5389: Removed duplicate words from error messages regarding non-overridable plugins. #5392: Fixed encoding errors when reading non-ASCII characters. #5355: Skip empty lines or unparseable rows. #5343: Prevent reuse of closed keep-alive sockets after remote disconnection. #5305: Correctly recover buffers even when paths contain . #5279: Restrict requests to the local host by default. POC Code or Exploit Code No specific POC code or exploit code is provided in the page.

Goal Reached Thanks to every supporter — we hit 100%!

Fluentd v1.19.3 Security Update: Strict Host Header Validation and Buffer Limits

More from this source