CVE-2021-41186: ReDoS vulnerability in parser_apache2
Vulnerability summary
CVE-2021-41186 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in fluent fluentd. EPSS estimates a 2.21% chance of exploitation in the next 30 days, higher than 82.6% of scored vulnerabilities.
Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 29-10-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. This issue is patched in version 1.14.2 There are two workarounds available. Either don't use parser_apache2 for parsing logs (which cannot guarantee generated by Apache), or put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable `FLUENT_PLUGIN` or `--plugin` option of fluentd).
CVSS metrics
4 scores · 3 sources · 2 versions- CVE.orgCNA5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · RubygemsEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
2.21%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.21% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Opensuse2 products
- ruby3.2-rubygem-fluentd&distro=openSUSE Tumbleweed< 1.15.3-1.4
- rubygem-fluentd&distro=openSUSE Tumbleweed< 1.17.0-1.1 | < 1.17.1-1.3 | < 1.17.1-1.5 | < 1.14.4-1.1
Fluent1 product
- fluentd≥ 0.14.14, < 1.14.2
Fluentd1 product
- fluentd≥ 0.14.14, ≤ 1.14.1
RubyGems1 product
- fluentd≥ 0.14.14, < 1.14.2
4 vendors · 5 products
References
9 links- github.com/fluent/fluentd/security/advisories/GHSA-hwhf-64mh-r662X Refsource CONFIRMWEBThird Party Advisory
- github.com/fluent/fluentd/blob/master/CHANGELOG.mdX Refsource MISCWEBRelease NotesThird Party Advisory
- lists.opensuse.org/archives/…Advisory
- github.com/fluent/fluentdPACKAGE