fluent-plugin-s3

Amazon S3 input and output plugin for Fluentd

View on Rubygems

View on Github

Activity

Latest release: 1w ago
Total releases: 99
Cadence: ~41 days
Last 12 months: 3

Reach

Stars: 322

Details

License: Apache-2.0
First release: Sep 26, 2011

Releases

Version	Released
`1.8.6` patch	Sep 04, 2026
`1.8.5` patch	Jun 25, 2026
`1.8.4` patch 1 CVE	Mar 04, 2026
`1.8.3` patch 1 CVE	Feb 18, 2025
`1.8.2` patch 1 CVE	Dec 18, 2024
`1.8.1` patch 1 CVE	Nov 15, 2024
`1.8.0` minor 1 CVE	Nov 13, 2024
`1.7.2` patch 1 CVE	Oct 19, 2022
`1.7.1` patch 1 CVE	Jul 15, 2022
`1.7.0` minor 1 CVE	Jun 14, 2022
`1.6.1` patch 1 CVE	Aug 19, 2021
`1.6.0` minor 1 CVE	Apr 09, 2021
`1.5.1` patch 1 CVE	Feb 16, 2021
`1.5.0` minor 1 CVE	Dec 18, 2020
`1.4.0` minor 1 CVE	Aug 03, 2020
`1.3.4` patch 1 CVE	Jul 07, 2020
`1.3.3` patch 1 CVE	Jun 25, 2020
`1.3.2` patch 1 CVE	May 18, 2020
`1.3.1` patch 1 CVE	Apr 15, 2020
`1.3.0` minor 1 CVE	Feb 10, 2020
`1.2.1` patch 1 CVE	Nov 11, 2019
`1.2.0` minor 1 CVE	Oct 18, 2019
`1.1.11` patch 1 CVE	Jun 17, 2019
`1.1.10` patch 1 CVE	May 09, 2019
`1.1.9` patch 1 CVE	Mar 27, 2019
`1.1.8` patch 1 CVE	Jan 28, 2019
`1.1.7` patch 1 CVE	Nov 15, 2018
`1.1.6` patch 1 CVE	Sep 12, 2018
`0.8.8` patch 1 CVE	Sep 06, 2018
`1.1.5` patch 1 CVE	Sep 05, 2018
`1.1.4` patch 1 CVE	Jul 23, 2018
`1.1.3` patch 1 CVE	Apr 15, 2018
`1.1.2` patch 1 CVE	Apr 10, 2018
`1.1.1` patch 1 CVE	Jan 10, 2018
`1.1.0` minor 1 CVE	Nov 30, 2017
`1.0.0` major 1 CVE	Nov 16, 2017
`1.0.0.rc8` pre 1 CVE	Oct 27, 2017
`0.8.7` patch 1 CVE	Oct 27, 2017
`0.8.6` patch 1 CVE	Oct 11, 2017
`1.0.0.rc7` pre 1 CVE	Oct 11, 2017
`1.0.0.rc6` pre 1 CVE	Aug 30, 2017
`1.0.0.rc5` pre 1 CVE	Aug 21, 2017
`0.8.5` patch 1 CVE	Aug 03, 2017
`1.0.0.rc4` pre 1 CVE	Jun 26, 2017
`0.8.4` patch 1 CVE	Jun 26, 2017
`0.8.3` patch 1 CVE	May 09, 2017
`1.0.0.rc3` pre 1 CVE	Mar 02, 2017
`0.8.2` patch 1 CVE	Mar 01, 2017
`1.0.0.rc2` pre 1 CVE	Jan 31, 2017
`0.8.1` patch 1 CVE	Jan 30, 2017

1–50 of 99

Repository

fluent/fluent-plugin-s3

Forks: 217
Open issues: 18
Language: Ruby
: 4.8/ 10

fluentd
s3
aws
fluentd-plugin

Dependencies (10)

Depends on

1.8.6

Used by

Supply-chain exposure

4 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (1)

CVE-2026-44162 GHSA-xv9w-7v6q-hpjh Jun 26, 2026

fluent-plugin-s3 Vulnerable to Denial of Service (DoS) via Decompression Bomb in `in_s3`

2.7 / 10
Low
Network Low High None Unchanged None None Low

The fluent-plugin-s3 plugin (specifically the in_s3 input plugin) supports reading and decompressing heavily compressed files (such as gzip, lzma2, and lzop) from Amazon S3. It was discovered that the plugin read the entire decompressed payload into memory at once without enforcing a strict size limit.

If an attacker has sufficient permissions to upload files to the monitored S3 bucket, they can upload a maliciously crafted, highly compressed file. When Fluentd attempts to decompress this file, it will expand to an excessive size and it will consume significant system resources.

Impact

This vulnerability allows for a Denial of Service (DoS) attack via memory exhaustion. The rapid memory consumption during decompression can lead to an Out-of-Memory kill of the Fluentd process by the operating system, This results in the disruption of all log collection on the affected node.

Patches

v1.8.5

Workarounds

If an immediate upgrade is not possible, mitigate the risk by applying strict IAM access controls:

Restrict Bucket Access

Ensure that write (PUT) access to the S3 bucket monitored by in_s3 is strictly limited to trusted services and administrators. Prevent any public or untrusted uploads to the S3 bucket.

Affected versions

0.7.00.7.10.7.20.8.00.8.0.rc10.8.10.8.20.8.30.8.40.8.50.8.60.8.7

+ 42 more Show less

0.8.81.0.01.0.0.rc11.0.0.rc21.0.0.rc31.0.0.rc41.0.0.rc51.0.0.rc61.0.0.rc71.0.0.rc81.1.01.1.11.1.101.1.111.1.21.1.31.1.41.1.51.1.61.1.71.1.81.1.91.2.01.2.11.3.01.3.11.3.21.3.31.3.41.4.01.5.01.5.11.6.01.6.11.7.01.7.11.7.21.8.01.8.11.8.21.8.31.8.4

Fixed in

1.8.5

References

https://github.com/fluent/fluent-plugin-s3/security/advisories/GHSA-xv9w-7v6q-hpjh
https://github.com/fluent/fluent-plugin-s3/commit/e085aee001d15bcc4bd073507e74075e30550fd0
https://github.com/fluent/fluent-plugin-s3

Updated Sep 10, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 1
minor 15
patch 72
pre 10

99 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More