Detections
Analytics

SCA: security update for fluent-plugin-s3 (GHSA-xv9w-7v6q-hpjh)

low Tenable Cloud Security Plugin ID 444009

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. From 0.7.0 to 1.8.4, the in_s3 input
 plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without
 enforcing a decompression_size_limit. An attacker with permission to upload objects to the monitored S3
 bucket can provide a highly compressed object that expands excessively when Fluentd processes it. The
 resulting memory exhaustion can cause the operating system to terminate the Fluentd process and disrupt
 all log collection on the affected node. This issue is fixed in version 1.8.5. (CVE-2026-44162)

Solution

Update the fluent-plugin-s3 library and its related packages to version 1.8.5 or later.

See Also

https://github.com/advisories/GHSA-xv9w-7v6q-hpjh

Plugin Details

Severity: Low

ID: 444009

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 6/26/2026

Updated: 9/15/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Low

Base Score: 3.3

Temporal Score: 2.4

Vector: CVSS2#AV:N/AC:L/Au:M/C:N/I:N/A:P

CVSS Score Source: CVE-2026-44162

CVSS v3

Risk Factor: Low

Base Score: 2.7

Temporal Score: 2.4

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/26/2026

Vulnerability Publication Date: 6/26/2026

Reference Information

CVE: CVE-2026-44162

cwe: CWE-770