CVE-2026-44163: 
Ruby vulnerability analysis and mitigation

CVE-2026-44163 is a Denial of Service (DoS) vulnerability in the fluent-plugin-opentelemetry Ruby gem's HTTP input component (in_opentelemetry) caused by the absence of strict size limits on incoming requests and decompressed payloads. Affected versions are all releases up to and including 0.5.2; the issue is patched in version 0.5.3. The vulnerability was published on June 26, 2026, by maintainer Watson1978 via a GitHub Security Advisory. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling): the in_opentelemetry HTTP input handler read the entire request body and decompressed gzip payloads into memory without enforcing any maximum size thresholds. An unauthenticated attacker can exploit this by sending either an oversized HTTP POST body or a "decompression bomb" — a small, highly compressed payload that expands to an enormous size in memory — to the OpenTelemetry ingestion endpoint (default port 4318). No authentication or special privileges are required; the only precondition is network access to the exposed endpoint. The fix (commit ce6c1f2) introduces two configurable parameters: body_size_limit (default 32 MiB) and decompression_size_limit (default 256 MiB), with chunked reading and early termination when limits are exceeded (GitHub Advisory, Fix Commit).

Successful exploitation causes memory exhaustion on the host running Fluentd, which can trigger an Out-of-Memory (OOM) kill of the Fluentd process by the operating system. This results in complete disruption of all log collection and forwarding capabilities on the affected node, with no impact on confidentiality or data integrity. There is no known path for lateral movement or data exfiltration through this vulnerability (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires no authentication and has low attack complexity, making it straightforward to exploit if the OpenTelemetry ingestion port (4318) is exposed to untrusted networks. The CVE status is currently "Reserved" and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Fluentd instances running fluent-plugin-opentelemetry <= 0.5.2 with port 4318 exposed, using network scanners such as Shodan or Censys.
2. Craft oversized payload (Option A — large body): Prepare an HTTP POST request with an extremely large body (e.g., hundreds of megabytes of arbitrary data) targeting an ingestion endpoint such as /v1/logs, /v1/traces, or /v1/metrics.
3. Craft decompression bomb (Option B — compressed payload): Create a gzip-compressed payload that decompresses to gigabytes of data (e.g., using nested or highly repetitive content), and set the Content-Encoding: gzip header.
4. Send the malicious request: Transmit the crafted HTTP POST request to http://<target>:4318/v1/logs (or equivalent endpoint). No authentication headers are required.
5. Trigger OOM kill: The plugin reads and/or decompresses the payload into memory without limit checks, rapidly exhausting available RAM and causing the OS to OOM-kill the Fluentd process, disabling all log collection on the node (GitHub Advisory).

• Network: Unusually large HTTP POST requests to port 4318 (default OpenTelemetry ingestion port) targeting paths /v1/logs, /v1/traces, or /v1/metrics; requests with Content-Encoding: gzip headers carrying disproportionately small compressed bodies relative to expected telemetry traffic.
• Logs: Fluentd logs containing warnings such as "Received too big content length" or "Received payload exceeding body_size_limit" or "Decompressed payload exceeding decompression_size_limit" (present only in patched v0.5.3); system logs (/var/log/syslog or dmesg) showing OOM killer events targeting the Fluentd process (e.g., Out of memory: Kill process <pid> (ruby/fluentd)).
• Process: Sudden termination of the Fluentd process without a clean shutdown; spike in memory usage by the Fluentd/Ruby process immediately preceding the crash (GitHub Advisory).

Upgrade fluent-plugin-opentelemetry to version 0.5.3 or later, which enforces a default body_size_limit of 32 MiB and a decompression_size_limit of 256 MiB, both configurable in the plugin's <http> section. If an immediate upgrade is not possible, restrict network access to port 4318 using firewall rules (e.g., iptables, AWS Security Groups) so only trusted sources can reach the endpoint. Alternatively, place a reverse proxy such as Nginx in front of Fluentd to enforce body size limits and handle gzip decompression before traffic reaches the plugin (GitHub Advisory, Fix Commit).