{"id":"CVE-2022-39379","aliases":["AZL-11396","BIT-fluentd-2022-39379","EUVD-2022-7331","GHSA-fppq-mj76-fpj2","OESA-2025-2320","OESA-2025-2321"],"status":"published","title":"Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)","description":"Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.","severity":{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.44983,"percentile":0.98796,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2022-11-02T00:00:00Z","modified":"2026-10-28T02:30:52Z","fixes":[{"ecosystem":"RubyGems","package":"fluentd","fixed_in":["1.15.3"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"rubygem-fluentd","fixed_in":["1.14.6-2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"fluentd","fixed_in":["1.15.3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"rubygem-fluentd","fixed_in":["1.14.5-3.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"rubygem-fluentd","fixed_in":["1.14.5-3.oe2203sp3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"fluentd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.2"},{"fixed":"1.15.3"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"rubygem-fluentd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.6-2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"fluentd","ranges":[{"type":"SEMVER","events":[{"introduced":"1.13.2"},{"fixed":"1.15.3"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"fluentd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.2"},{"fixed":"1.15.3"}]}],"versions":["1.13.2","1.13.3","1.14.0","1.14.0.rc","1.14.1","1.14.2","1.14.3","1.14.4","1.14.5","1.14.6","1.15.0","1.15.1","1.15.2"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"rubygem-fluentd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.5-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"rubygem-fluentd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.5-3.oe2203sp3"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"fluent","product":"fluentd"},{"vendor":"fluentd","product":"fluentd"}],"references":[{"url":"https://github.com/fluent/fluentd/security/advisories/GHSA-fppq-mj76-fpj2","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/fluent/fluentd/commit/48e5b85dab1b6d4c273090d538fc11b3f2fd8135","tags":["x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MYD5QV66OLDHES6IKVYYM3Y3YID3VVCO/","tags":["vendor-advisory","x_transferred","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39379","tags":["web","advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/fluentd/CVE-2022-39379.yml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MYD5QV66OLDHES6IKVYYM3Y3YID3VVCO/"},{"url":"https://github.com/advisories/GHSA-fppq-mj76-fpj2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39379.json","tags":["advisory"]},{"url":"https://github.com/fluent/fluentd","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MYD5QV66OLDHES6IKVYYM3Y3YID3VVCO","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2320","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2321","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-39379","title":"Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)","description":"Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.","status":"published","published":"2022-11-02T00:00:00Z","modified":"2025-04-23T16:41:33.585Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:34:39.233406Z"}],"euvd":[{"id":"EUVD-2022-7331","description":"Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.","status":"published","published":"2022-11-02T00:00:00Z","modified":"2025-04-23T16:41:33Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T20:52:11.891054Z"}],"ghsa":[{"id":"GHSA-fppq-mj76-fpj2","title":"fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)","description":"### Impact\nA remote code execution (RCE) vulnerability in non-default configurations of Fluentd  allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads.\n\nFluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`.\n\nPlease note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability.\n\n### Patches\nv1.15.3\n\n### Workarounds\nDo not use `FLUENT_OJ_OPTION_MODE=object`.\n\n### References\n\n* GHSL-2022-067\n","status":"published","published":"2022-11-02T18:15:35Z","modified":"2023-01-27T05:04:07Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:36:20.985872Z"}],"nvd":[{"id":"CVE-2022-39379","description":"Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.","status":"published","published":"2022-11-02T13:15:13.583Z","modified":"2026-06-17T04:58:14.957Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:07:31.504574Z"}],"osv":[{"id":"AZL-11396","title":"CVE-2022-39379 affecting package rubygem-fluentd for versions less than 1.14.6-2","description":"Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.","status":"published","published":"2022-11-02T13:15:13Z","modified":"2026-04-21T04:22:06.080405Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:02.666535Z"},{"id":"CVE-2022-39379","title":"Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)","description":"Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.","status":"published","published":"2022-11-02T00:00:00Z","modified":"2026-10-28T02:30:52.12300394Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:44:26.860704Z"},{"id":"GHSA-fppq-mj76-fpj2","title":"fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)","description":"### Impact\nA remote code execution (RCE) vulnerability in non-default configurations of Fluentd  allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads.\n\nFluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`.\n\nPlease note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability.\n\n### Patches\nv1.15.3\n\n### Workarounds\nDo not use `FLUENT_OJ_OPTION_MODE=object`.\n\n### References\n\n* GHSL-2022-067\n","status":"published","published":"2022-11-02T18:15:35Z","modified":"2024-02-21T05:28:11.809766Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"OESA-2025-2320","title":"rubygem-fluentd security update","description":"Fluentd is an open source data collector designed to scale and simplify log management. It can collect, process and ship many kinds of data in near real-time.\r\n\r\nSecurity Fix(es):\n\nFluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.(CVE-2022-39379)","status":"published","published":"2025-09-19T11:09:23Z","modified":"2026-08-18T01:19:11.122745996Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2321","title":"rubygem-fluentd security update","description":"Fluentd is an open source data collector designed to scale and simplify log management. It can collect, process and ship many kinds of data in near real-time.\r\n\r\nSecurity Fix(es):\n\nFluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.(CVE-2022-39379)","status":"published","published":"2025-09-19T11:09:23Z","modified":"2026-08-18T01:19:11.457667896Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"BIT-fluentd-2022-39379","title":"Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)","description":"Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.","status":"published","published":"2024-03-06T10:51:50.613Z","modified":"2026-09-08T08:47:17.54007825Z","updated_at":"2026-11-02T15:28:29.563843Z"}]}}