The fluent-plugin-opentelemetry plugin's in_opentelemetry HTTP input does not enforce maximum size thresholds on incoming request bodies. It reads and decompresses the entire payload into memory without limits, enabling an attacker to send large or maliciously compressed requests that expand to excessive sizes. This results in rapid memory consumption that can cause the Fluentd process to be terminated by the operating system, disrupting log collection and forwarding. The vulnerability is identified as CVE-2026-44163 and affects versions before 0.5.3. The issue is classified under CWE-770 (Allocation of Resources Without Limits or Throttling).

This vulnerability allows an unauthenticated attacker to cause a Denial of Service (DoS) by exhausting memory resources on the affected system. The Fluentd process may be killed by the operating system due to out-of-memory conditions, resulting in loss of log collection and forwarding capabilities on the affected node. There is no impact on confidentiality or integrity reported.

An official patch is available in version 0.5.3; upgrading to this version or later fully mitigates the vulnerability. If immediate upgrade is not possible, users should restrict network access to the OpenTelemetry ingestion port (default 4318) to trusted networks only, using firewall rules or security groups. Additionally, deploying a reverse proxy such as Nginx in front of Fluentd to handle gzip decompression and enforce strict limits on both compressed and uncompressed request body sizes is recommended to prevent exploitation.