Fluentd Blog

Fluentd v1.19.4 has been released

Hi users!

We have released v1.19.4 on 2026-09-29. ChangeLog is here.

This release is a maintenance release of v1.19 series.

This release will be bundled for fluent-package LTS version v6.0.5!

Security Fixes

Many vulnerabilities were fixed in this release.

• Incomplete Fix for CVE-2026-44024: Path Traversal Bypass via Bare .. Tag in Output Plugins
  • CVE ID pending (this page will be updated once assigned)
  • CVSS v3 score: 7.5/10 (High)
  • Workarounds: Restrict network access, allow connection within a closed, trusted network. Run fluentd as non-root user. Do not use the ${tag} placeholder in the path parameter of output plugins. Filter incoming untrusted tags.
• Out-of-Memory DoS via Object Allocation Amplification in in_http ndjson parsing
  • CVE ID pending (this page will be updated once assigned)
  • CVSS v3 score: 7.5/10 (High)
  • Workarounds: Restrict network access for in_http, allow connection within a closed, trusted network. Implement reverse proxy limits with forcing strict rate limiting and request size limits at the proxy layer to drop anomalous requests before they reach the Fluentd worker.
• Out-of-Memory DoS via Unbounded TCP/TLS Connection Buffer in in_syslog
  • CVE ID pending (this page will be updated once assigned)
  • CVSS v3 score: 7.5/10 (High)
  • Workarounds: Restrict network access for in_syslog, allow connection within a closed, trusted network. Switch to UDP Transport for a while. Implement reverse proxy limits with strict client connection timeout and buffer size limits to terminate anomalous, non-delimited streams before they overwhelm Fluentd.
• Incomplete Fix for CVE-2026-44160: DoS via Unbounded Decompression in Buffer Chunk Streaming
  • CVE ID pending (this page will be updated once assigned)
  • CVSS v3 score: 2.9/10 (Low)
  • Workarounds: Disable buffer compression. Disable automatic chunk backup with disable_chunk_backup true. Restrict incoming data only within a closed, trusted network.

In most cases, there is no problem using deployed Fluentd within a closed, trusted network. If you could not update Fluentd immediately, consider to take advised mitigation in above advisories.

Bug Fixes

Many bugs were also fixed in this release.

• output: fix JSON::GeneratorError as unrecoverable error. (#5423)
  • Failure for content reasons (e.g. non-UTF-8 bytes, NaN/Infinity), is treated as a bad chunk.
• Set allow_duplicate_key parameter for JSON.parse. It accept duplicate keys silently (last value wins) on every path. It keeps compatibility with older versions even though newer json gem is used. (#5430)
• Set allow_comments parameter for JSON.parse. It accepts JSON with comments. It keeps compatibility with older versions even though newer json gem is used. (#5432)
• Accept a bare scalar for an array option in YAML syntax (#5433)
• parser_syslog: Optimize RFC5424 structured data parsing (#5444)
  • It avoids excessive backtracking when parsing malformed RFC5424 structured data.
• out_forward: drop keepalive sockets with failed or mismatched acks (#5445)
  • It stops the endless "ack in response and chunk id in sent data are different" warning storm by discarding (instead of reusing) a keepalive socket.
• buffer: fix stage_byte_size leak when a staged chunk is unstaged (#5456)
  • There was a possibility that it could eventually raise spurious BufferOverflowError. It affects plugins which implementing #format.
• plugin base: bound the number of worker lock files by hashing the path into a fixed set of buckets. (#5471)
• supervisor: reduce memory usage of cleanup_lock_dir with huge number of lock files (#5472)
• config: accept empty lines in quoted strings (#5478)
• chunk: ensure to close the Tempfile for decompressed data (#5486)
• buffer: fix spurious BufferOverflowError caused by queue_size leaking when a chunk purge fails (#5487)
• buffer: clamp exported buffer size metrics to non-negative values (#5488)
• Support json gem v3.x (#5493)
• parser_syslog: fix NameError when RFC3164 timestamp has repeated spaces (#5497)
• parser_syslog: fix NameError when RFC5424 timestamp has repeated spaces (#5500)

Accept a bare scalar for an array option in YAML syntax

In the previous versions, a single scalar value for an array option is rejected in YAML config syntax.

Since v1.19.4, it accepts the following example.

config:
  - match:
      $tag: "**"
      $type: http
      retryable_response_codes: 503

plugin base: bound the number of worker lock files by hashing the path into a fixed set of buckets

When workers > 1, out_file (with append) and out_secondary_file take an inter-worker lock per output path, and get_lock_path derives one lock file per path: /tmp/fluentd-lock-*/fluentd-<sanitized path>.lock.

In the previous versions, a lock file is never removed while fluentd is running; the only cleanup is cleanup_lock_dir at a graceful shutdown. So the number of lock files grows with the number of unique output paths, and with a date or a tag placeholder in path that set is effectively unbounded over time.

In this release, the number of lock files is now bounded by a constant instead of by the number of unique paths. The accumulation, the mass deletion at shutdown, and the dependence on an external tmp cleaner all disappear structurally rather than being mitigated.

Enjoy logging!

Follow us on X

We have been posting information about Fluentd in Japanese on @fluentd_jp. We would appreciate it if you followed the X account.