CVE-2021-41186
mediumpriority · track · 31EPSS 0.022 · 83 %ileDEEUUSEPSS · scored 2026-10-27
Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. This issue is patched in version 1.14.2 There are two workarounds available. Either don't use parser_apache2 for parsing logs (which cannot guarantee generated by Apache), or put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable `FLUENT_PLUGIN` or `--plugin` option of fluentd).
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedruby4.0-rubygem-fluentd-0:1.17.1-1.5.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedruby4.0-rubygem-fluentd-0:1.17.1-1.5.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedruby4.0-rubygem-fluentd-0:1.17.1-1.5.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedruby4.0-rubygem-fluentd-0:1.17.1-1.5.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (28)
Products and version ranges known to be affected.
advisories (5)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2025-0001IBM DB2: Mehrere SchwachstellenDeutsch2025-01-01csaf · cert_bundDE
Ein entfernter oder lokaler Angreifer kann mehrere Schwachstellen in IBM DB2 on Cloud Pak for Data ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen.
- WID-SEC-W-2025-1088Fluentd: Schwachstelle ermöglicht Denial of ServiceDeutsch2021-10-28csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Fluentd ausnutzen, um einen Denial of Service Angriff durchzuführen.
- openSUSE-SU-2026:10346-1ruby4.0-rubygem-fluentd-1.17.1-1.5 on GA media2026-03-13csaf · suse_csafDE
ruby4.0-rubygem-fluentd-1.17.1-1.5 on GA media
- GHSA-hwhf-64mh-r662ReDoS vulnerability in parser_apache22021-11-01ghsa · osvUS
### Impact parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. ### Patches v1.14.2 ### Workarounds Either of the following: * Don't use parser_apache2 for parsing logs which cannot guarantee generated by Apache. * Put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable `FLUENT_PLUGIN` or `--plugin` option of fluentd). ### References * [CVE-2021-41186](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41186) * [GHSA-hwhf-64mh-r662](https://github.com/fluent/fluentd/security/advisories/GHSA-hwhf-64mh-r662) * [GHSL-2021-102](https://securitylab.github.com/advisories/GHSL-2021-102-fluent-fluentd/) * https://github.com/fluent/fluentd/blob/master/CHANGELOG.md#v1142
- BIT-fluentd-2021-41186ReDoS vulnerability in parser_apache22024-03-06vendor · osvUS
Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. This issue is patched in version 1.14.2 There are two workarounds available. Either don't use parser_apache2 for parsing logs (which cannot guarantee generated by Apache), or put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable `FLUENT_PLUGIN` or `--plugin` option of fluentd).
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2021-41186cnnvd
- https://github.com/fluent/fluentd/blob/master/CHANGELOG.md#v1142cnnvd
- https://github.com/fluent/fluentd/security/advisories/GHSA-hwhf-64mh-r662cnnvd
- https://github.com/github/securitylab-vulnerabilities/blob/52dc4a2a828c6dc24231967c2937ad92038184a9/vendor_reports/GHSL-2021-102-fluent-fluentd.mdcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-41186cnnvd
- https://github.com/fluent/fluentd/blob/master/CHANGELOG.md#v1142enisa_euvd
- https://github.com/fluent/fluentd/security/advisories/GHSA-hwhf-64mh-r662enisa_euvd
- https://github.com/github/securitylab-vulnerabilities/blob/52dc4a2a828c6dc24231967c2937ad92038184a9/vendor_reports/GHSL-2021-102-fluent-fluentd.mdenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan