Fluentd's `in_http` and `in_forward` plugins accept gzip-compressed data and enforce size limits on compressed payloads but do not limit the size of decompressed data. An attacker can exploit this by sending a specially crafted compressed payload that decompresses to a very large size, bypassing the intended payload size limits. This leads to rapid memory consumption and potential process termination due to out-of-memory conditions, resulting in denial of service. The vulnerability affects Fluentd versions before 1.19.3.

The vulnerability enables denial of service through memory exhaustion caused by decompressing maliciously crafted gzip payloads. This can cause the Fluentd process to be terminated by the operating system, resulting in loss of logging and forwarding functionality on the affected system.

A fixed version, Fluentd 1.19.3, is available and should be applied to remediate this vulnerability. If immediate upgrade is not possible, restrict network access to Fluentd input ports (e.g., 9880 for `in_http` and 24224 for `in_forward`) to trusted networks using firewall rules. Additionally, placing a reverse proxy such as Nginx in front of Fluentd to handle gzip decompression and enforce strict limits on both compressed and decompressed payload sizes is recommended.