fluent-plugins-nursery vulnerabilities and threats

CVE-2026-44163 is a medium severity vulnerability in fluent-plugin-opentelemetry prior to version 0.5.3. The in_opentelemetry HTTP input component reads and decompresses incoming request bodies into memory without enforcing size limits, allowing attackers to send highly compressed payloads that expand significantly in memory. This can lead to memory exhaustion and cause the Fluentd process to be terminated by the operating system, disrupting log collection and forwarding on the affected node. The issue is fixed in version 0.5.3.