Fluentd Blog

Scheduled support lifecycle announcement about Fluent Package v7

Hi users!

We had launched fluent-package v6 series last year, recently shipped v6.0.4 in LTS release channel.

In this blog article, we explain the planned next major updates - v7.0.0.

When the next LTS (Long Term Support) version available?

In short, we will ship fluent-package v7 in Aug, 2027.

We keep two release channels as follows:

• Normal release
• LTS (Long Term Support)

Here is the difference of these channels.

• Normal release (7.x series)
  • Recommended for early adopters (eager to try new features of Fluentd)
  • Regular releases are not guaranteed. (planned semi-annually releases, but it may vary. In some cases, the LTS version may actually be newer.)
  • Fluentd will be upgraded occasionally
    • Minor upgrade will be applied. e.g. 1.20 => 1.21 and so on.
    • e.g. v7.0.1 (Fluentd v1.20.1), v7.0.2 (Fluentd v1.20.2), ... v7.1.0 (Fluentd v1.21.0)
  • The only latest version will be supported
• LTS (Long Term Support, 7.0.x series)
  • Recommended for enterprise services
  • Security and bug fix release only
  • Fluentd will be upgraded only in the teeny version and will stick to 1.20.x series. (T.B.D.)
    • Thus, the version number will be 7.0.x. (7.1 series will not be shipped for LTS channel)
    • e.g. v7.0.1 (Fluentd v1.20.1), v7.0.2 (Fluentd v1.20.2), v7.0.3 (Fluentd v1.20.3) ... v7.0.x (Fluentd v1.20.x) and so on.
  • Next major version will be fluent-package v8.0.0, and will be shipped in 2029 (T.B.D.).

As for fluent-package v7,

• fluent-package v6 LTS will be supported until Dec, 2027.
  • We expect users upgrade from v6 to v7 during the grace period.
• Until 7.1.0 is released, normal release channel and LTS channel are the same package.
• Upgrade from v4 or older version is not supported. Upgrade to v5 or v6 first, then upgrade it to v7.

Current releases and future plans:

Happy logging!

Read More

fluent-package v6.0.4 has been released

Hi users!

We have released fluent-package v6.0.4 on 2026-06-26. Fluent Package is a stable distribution package of Fluentd. (successor of td-agent)

This is a maintenance release of v6.0.x LTS series.

Fluent Package v6.0.4

Fluent Package v6.0.4 includes the following improvements:

• Updated bundled Fluentd to v1.19.3 which fixes some vulnerabilities.

This article explains the changes in Fluent Package v6.0.4.

Changes

Updated bundled Fluentd to v1.19.3 which fixes some vulnerabilities.

In this release, some critical vulnerabilities were fixed.

• Remote Code Execution (RCE) via Arbitrary File Write in ${tag} Placeholder
  • CVE-2026-44024
  • CVSS v3 score: 9.8/10 (Critical)
  • Workarounds: Restrict network access, run as non-root user, use shared_key for authentication, filter incoming untrusted tags.
• Exposure of Sensitive Information via Monitor Agent API
  • CVE-2026-44025
  • CVSS v3 score: 7.5/10 (High)
  • Workarounds: Restrict network access for in_monitor_agent, allow connection from only localhost.
• Denial of Service (DoS) via Gzip Decompression Bomb in in_http and in_forward
  • CVE-2026-44160
  • CVSS v3 score: 7.5/10 (High)
  • Workarounds: Restrict network access for in_forward or in_http, use shared_key for authentication which allow trusted incoming source.
• Server-Side Request Forgery (SSRF) via out_http Placeholder Expansion
  • CVE-2026-44161
  • CVSS v3 score: 7.2/10 (High)
  • Workarounds: Avoid usage of dynamic hostname in placeholder, restrict network access from untrusted network, use only allowed hosts.
• Denial of Service (DoS) via Large Payloads and Decompression Bombs in in_opentelemetry
  • CVE-2026-44162
  • CVSS v3 score: 5.3/10 (Moderate)
  • Workarounds: Restrict network access for in_opentelemetry, use a robust reverse proxy in front of Fluentd to mitigate GZIP decompression bomb.
• Denial of Service (DoS) via Decompression Bomb in in_s3
  • CVE-2026-44163
  • CVSS v3 score: 2.7/10 (Low)
  • Workarounds: Ensure that write (PUT) access to the S3 bucket monitored by in_s3 is strictly limited to trusted services and administrators.

The above vulnerabilities affects to older than v1.19.3, thus the following packages also will be affected.

• fluent-package LTS v6.0.3 or earlier
• fluent-package Standard edition v6.0.0 (NOTE: no patched version planned yet, please consider to use LTS)
• fluent-package LTS v5.0.9 or earlier (NOTE: v5.0.x already reached EOL, no patched updates anymore)
• fluent-package Standard edition v5.2.0 or earlier (NOTE: v5.x already reached EOL, no patched updates anymore)
• All of td-agent (NOTE: td-agent already reached EOL, no patched updates anymore)

We recommend upgrading fluent-package to v6.0.4.

If you can't upgrade it immediately, there is a case that mitigation method is explained in above advisory. Please check each advisory and take care of it.

Download

Please visit the download page.

Announcement

About next LTS schedule

We plan to release the next LTS version of fluent-package v6.0.5 at Sep 2026. The content of updates are still TBD.

Follow us on X

We have been posting information about Fluentd in Japanese on @fluentd_jp. We would appreciate it if you followed the X account.

Read More

Fluentd v1.19.3 has been released

Hi users!

We have released v1.19.3 on 2026-06-25. ChangeLog is here.

This release is a maintenance release of v1.19 series.

This release is bundled for fluent-package LTS version v6.0.4!

Security Fixes

Many vulnerabilities were fixed in this release.

• Remote Code Execution (RCE) via Arbitrary File Write in ${tag} Placeholder
  • CVE-2026-44024
  • CVSS v3 score: 9.8/10 (Critical)
  • Workarounds: Restrict network access, run as non-root user, use shared_key for authentication, filter incoming untrusted tags.

• Exposure of Sensitive Information via Monitor Agent API

  • CVE-2026-44025
  • CVSS v3 score: 7.5/10 (High)
  • Workarounds: Restrict network access for in_monitor_agent, allow connection from only localhost.
  • Breaking changes: If you dare to keep previous non-secure behavior, need tweak include_config, include_retry and include_debug_info parameters.

  <source>
    @type monitor_agent
    include_config true     # since v1.19.3, changed to false by default
    include_retry true      # since v1.19.3, newly introduced, false by default
    include_debug_info true # since v1.19.3, newly introduced, false by default
    ...
  </source>
  

• Denial of Service (DoS) via Gzip Decompression Bomb in in_http and in_forward

  • CVE-2026-44160
  • CVSS v3 score: 7.5/10 (High)
  • Workarounds: Restrict network access for in_forward or in_http, use shared_key for authentication which allow trusted incoming source.

• Server-Side Request Forgery (SSRF) via out_http Placeholder Expansion

  • CVE-2026-44161
  • CVSS v3 score: 7.2/10 (High)
  • Workarounds: Avoid usage of dynamic hostname in placeholder, restrict network access from untrusted network, use only allowed hosts.

Additionally, similar vulnerability was also fixed in the following fluentd plugins:

• fluent-plugin-s3 DoS via Gzip decompression vulnerability was fixed in 1.8.5
• fluent-plugin-opentelemetry DoS via Gzip decompression vulnerability was fixed in 0.5.3

In most cases, there is no problem using deployed Fluentd within a closed, trusted network. If you could not update Fluentd immediately, consider to take advised mitigation in above advisories.

Bug Fixes

Many bugs were also fixed in this release.

• in_debug_agent: accept only from local machine by default
• buffer: resume buffer correctly even though path contains []
• out_forward: avoid reusing closed keepalive sockets after remote
• storage_local: fix encoding error when fix encoding error when reading non-ASCII characters

in_debug_agent: accept only from local machine by default

Historically, in_debug_agent accepts remote access by default.

This behavior is not problem because usually in_debug_agent must be explicitly enabled by users who know what you do.

But, there is an security concern which accepts external access by default even though user must enable it explicitly.

To mitigate security concern, changed that behavior a bit secure by default.

If you dare to keep previous non-secure behavior, specify 0.0.0.0 explicitly.

<source>
  @type monitor_agent
  bind 0.0.0.0   # prior to v1.19.3 default behavior
  bind 127.0.0.1 # since v1.19.3 default behavior
  ...
</source>

buffer: resume buffer correctly even though path contains []

If buffer path contains [] in tag something like "path test/${tag[0]}", when resuming buffer process can't find them without escaping bracket.

Thus buffer files remains under that directory.

In this release, that can be resumed correctly.

Note that recommended tag spec is specified in routing documentation, but it is easily shoot your legs in practical use-case if you use [] characters. so it is changed to take care of that case.

avoid reusing closed keepalive sockets after remote disconnects

In the previous versions, there was a keepalive socket reuse bug.

When a cached keepalive connection has already been closed by the remote side, out_forward could pick that socket back up and try to write to it again.

As a result, that left the flush thread spinning on a dead socket and can drive CPU usage to 100%.

storage_local: fix encoding error when fix encoding error when reading non-ASCII characters

If data containing non-latin characters are stored onto disk using the storage_local plugin, the file is properly written but cannot be read again once fluentd restarts. Now that behaviour was fixed by properly handling the file encoding.

Improvements

In this release, added some warnings for problematic use-cases.

• warn recommended exclusion path for antivirus
• buffer: warn if default timekey (1d) will be used
• output windows: check shorter service timeout on shutdown

If there are any potential issues with your configuration, Fluentd detects above cases additionally.

Enjoy logging!

Follow us on X

We have been posting information about Fluentd in Japanese on @fluentd_jp. We would appreciate it if you followed the X account.

Read More

fluent-package v6.0.3 has been released

Hi users!

We have released fluent-package v6.0.3 on 2026-03-27. Fluent Package is a stable distribution package of Fluentd. (successor of td-agent)

This is a maintenance release of v6.0.x LTS series.

Fluent Package v6.0.3

Fluent Package v6.0.3 includes the following improvements:

• Fixed a severe memory leak issue in the bundled cool.io v1.9.3 under specific conditions
• Updated bundled Ruby to 3.4.9
• Updated bundled Nokogiri to v1.19.2 (Windows only) for vulnerability fix

This article explains the changes in Fluent Package v6.0.3.

Changes

Fixed a severe memory leak issue in the bundled cool.io v1.9.3

In fluent-package v6.0.2, a critical issue was discovered where memory usage continuously increases over time. This release completely resolves this problem.

• Affected Environments
  • This issue occurs in environments where TCP connections are frequently connected and disconnected.
  • It is easily reproducible when using the out_forward plugin with the keepalive false setting (which is the default value).
• Root cause
  • The asynchronous I/O library cool.io (v1.9.2 and v1.9.3) bundled in fluent-package v6.0.2 had a bug in its detachment process.
  • When a TCP connection was detached, the internal watcher objects were not properly garbage collected, leaving "garbage" data accumulated in the memory.
• Resolution
  • We have released cool.io v1.9.4 which fixes this bug, and it is now bundled by default in fluent-package v6.0.3.

If operated for a long period, this memory leak will exhaust system memory resources, eventually causing the Fluentd process to be terminated unexpectedly by the OOM (Out of Memory) Killer. We strongly recommend users who are using out_forward on v6.0.2 to update to this version immediately.

Note: Users on fluent-package v6.0.1 or earlier are not affected by this specific issue.

Updated bundled Ruby to 3.4.9

Ruby 3.4.9 includes multiple bug and security fixes. Specifically, it addresses the following vulnerability:

• CVE-2026-27820

For details, please see the Ruby 3.4.9 release notes.

Updated bundled Nokogiri (Windows only) for vulnerability fix

We have updated the bundled Nokogiri from v1.18.10 to v1.19.2 for the Windows version to address the following vulnerability:

• Nokogiri does not check the return value from xmlC14NExecute

Download

Please visit the download page.

Announcement

About next LTS schedule

We plan to release the next LTS version of fluent-package v6.0.4 at June 2026. The content of updates are still TBD.

Follow us on X

We have been posting information about Fluentd in Japanese on @fluentd_jp. We would appreciate it if you followed the X account.

Read More

fluent-package v6.0.2 has been released

Hi users!

We have released fluent-package v6.0.2 on 2026-02-27. Fluent Package is a stable distribution package of Fluentd. (successor of td-agent)

This is a maintenance release of v6.0.x LTS series.

Fluent Package v6.0.2

Fluent Package v6.0.2 includes the following improvements:

• Updated bundled Ruby to 3.4.8
• Updated bundled Fluentd from v1.19.1 to v1.19.2
  • Fluentd v1.19.2 has been released
• rpm: fixed update error if working directory was removed
• Fixed CVEs about bundled gems: CVE-2025-14762, CVE-2026-25765
  • When using with fluentd, usually it will not be affected by these vulnerability, but bundled fixed versions with keeping compatibility.
• msi: fixed installation rollback issue when executing maintenance script

This article explains the changes in Fluent Package v6.0.2.

Changes

Updated bundled Ruby to 3.4.8

Ruby 3.4.8 includes multiple bug and security fixes. For details, please see the Ruby 3.4.8 release notes.

Updated bundled Fluentd from v1.19.1 to v1.19.2

Fluentd v1.19.2 includes the following fixes:

• Fixed duplicate configuration file loading in config_include_dir
• in_tail: fixed error when files without read permission are included in glob patterns
• out_forward: added timeout to prevent infinite loop under unstable network connection
• gem: use latest net-http to solve IPv6 addr error
• warn when backed-up conf file will be included

For details, please see the Fluentd v1.19.2 has been released.

rpm: fixed update error if working directory was removed

In this release, it was fixed update error if temporary working directory was removed.

In the previous versions, if temporary working directory was removed by tmpfiles.d, there was a case that updating to v6 (up to v6.0.1) causes fatal error while rpm processes transaction.

Now, with changing temporary working directory handling, it was fixed in v6.0.2.

msi: fixed installation rollback issue when executing maintenance script

Since v6.0.0, installation maintenance script (powershell) was partially introduced for Windows. But in some environments, there is a case that the execution of powershell was prohibited in your policy. In such a case, installation process will be failed unexpectedly.

In this release, added fallback not to terminate installation process accidentally.

Download

Please visit the download page.

Announcement

About next LTS schedule

We plan to release the next LTS version of fluent-package v6.0.3 at June 2026. The content of updates are still TBD.

Follow us on X

We have been posting information about Fluentd in Japanese on @fluentd_jp. We would appreciate it if you followed the X account.

Read More