CVE-2021-41186
ReDoS vulnerability in parser_apache2
Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. This issue is patched in version 1.14.2 There are two workarounds available. Either don't use parser_apache2 for parsing logs (which cannot guarantee generated by Apache), or put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable FLUENT_PLUGIN or --plugin option of fluentd).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
ReDoS vulnerability in parser_apache2
Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. This issue is patched in version 1.14.2 There are two workarounds available. Either don't use parser_apache2 for parsing logs (which cannot guarantee generated by Apache), or put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable FLUENT_PLUGIN or --plugin option of fluentd).
- Record
CVE-2021-41186- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2021-2358
Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. This issue is patched in version 1.14.2 There are two workarounds available. Either don't use parser_apache2 for parsing logs (which cannot guarantee generated by Apache), or put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable FLUENT_PLUGIN or --plugin option of fluentd).
- Record
EUVD-2021-2358- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hwhf-64mh-r662
ReDoS vulnerability in parser_apache2
Impact
parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack.
Patches
v1.14.2
Workarounds
Either of the following:
- Don't use parser_apache2 for parsing logs which cannot guarantee generated by Apache.
- Put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable
FLUENT_PLUGINor--pluginoption of fluentd).
References
- Record
GHSA-hwhf-64mh-r662- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. This issue is patched in version 1.14.2 There are two workarounds available. Either don't use parser_apache2 for parsing logs (which cannot guarantee generated by Apache), or put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable FLUENT_PLUGIN or --plugin option of fluentd).
- Record
CVE-2021-41186- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. This issue is patched in version 1.14.2 There are two workarounds available. Either don't use parser_apache2 for parsing logs (which cannot guarantee generated by Apache), or put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable FLUENT_PLUGIN or --plugin option of fluentd).
- Record
CVE-2021-41186- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-hwhf-64mh-r662
ReDoS vulnerability in parser_apache2
Impact
parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack.
Patches
v1.14.2
Workarounds
Either of the following:
- Don't use parser_apache2 for parsing logs which cannot guarantee generated by Apache.
- Put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable
FLUENT_PLUGINor--pluginoption of fluentd).
References
- Record
GHSA-hwhf-64mh-r662- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
Show 6 moreShow less
OSVBIT-fluentd-2021-41186 No score
ReDoS vulnerability in parser_apache2
Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. This issue is patched in version 1.14.2 There are two workarounds available. Either don't use parser_apache2 for parsing logs (which cannot guarantee generated by Apache), or put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable FLUENT_PLUGIN or --plugin option of fluentd).
- Record
BIT-fluentd-2021-41186- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11795-1 No score
ruby3.1-rubygem-fluentd-1.14.4-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-fluentd-1.14.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11795-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13155-1 No score
ruby3.2-rubygem-fluentd-1.15.3-1.4 on GA media
These are all security issues fixed in the ruby3.2-rubygem-fluentd-1.15.3-1.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13155-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14072-1 No score
ruby3.3-rubygem-fluentd-1.17.0-1.1 on GA media
These are all security issues fixed in the ruby3.3-rubygem-fluentd-1.17.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14072-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15115-1 No score
ruby3.4-rubygem-fluentd-1.17.1-1.3 on GA media
These are all security issues fixed in the ruby3.4-rubygem-fluentd-1.17.1-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15115-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10346-1 No score
ruby4.0-rubygem-fluentd-1.17.1-1.5 on GA media
These are all security issues fixed in the ruby4.0-rubygem-fluentd-1.17.1-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10346-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
fluentdRubyGems |
0.14.14 up to 1.14.2 | 1.14.2 |
fluentdBitnami |
0.14.14 up to 1.14.2 | 1.14.2 |
fluentdRubyGems |
0.14.14 up to 1.14.2, plus listed versions 0.14.150.14.160.14.170.14.180.14.19 Show 45 moreShow less0.14.200.14.20.rc10.14.210.14.220.14.22.rc10.14.22.rc20.14.230.14.23.rc10.14.240.14.251.0.01.0.0.rc11.0.11.0.21.1.01.1.11.1.21.1.31.10.01.10.11.10.21.10.31.10.41.11.01.11.11.11.21.11.31.11.41.11.51.12.01.12.0.rc11.12.0.rc21.12.11.12.21.12.31.12.41.13.01.13.11.13.21.13.31.14.01.14.0.rc1.14.11.2.01.2.0.pre1 |
1.14.2 |
rubygem-fluentdopenSUSE:Tumbleweed |
before 1.14.4-1.1 | 1.14.4-1.1 |
ruby3.2-rubygem-fluentdopenSUSE:Tumbleweed |
before 1.15.3-1.4 | 1.15.3-1.4 |
rubygem-fluentdopenSUSE:Tumbleweed |
before 1.17.0-1.1 | 1.17.0-1.1 |
rubygem-fluentdopenSUSE:Tumbleweed |
before 1.17.1-1.3 | 1.17.1-1.3 |
rubygem-fluentdopenSUSE:Tumbleweed |
before 1.17.1-1.5 | 1.17.1-1.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-41186 is a medium vulnerability (CVSS 5.9) in Fluent Fluentd, published October 29, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.21%, the 82nd percentile. Fixed in fluentd 1.14.2.
References
github.com/fluent/fluentd/security/advisories/GHSA-hwhf-64mh-r662
nvd.nist.gov/vuln/detail/CVE-2021-41186
Left out here: 40 versions. The JSON record has them.