Fluentd's in_syslog plugin allows receiving syslog messages over UDP, TCP, and TLS. It was discovered that the plugin is vulnerable to an unauthenticated remote memory exhaustion (OOM) attack when configured to use TCP or TLS transport.

While the message_length_limit parameter correctly bounds payload sizes for UDP inputs, the TCP and TLS handlers append incoming data to an unbounded per-connection buffer before parsing. An attacker can exploit this missing validation by establishing a TCP/TLS connection and continuously streaming bytes without sending the configured delimiter (Traditional Framing), or by declaring a massive frame length but never completing the payload (Octet-Count Framing). In both scenarios, Fluentd buffers the incomplete data indefinitely, allowing a single connection to exhaust system memory and crash the worker process.

Impact

This vulnerability allows for an unauthenticated remote Denial of Service (DoS). By sending crafted, unterminated, or malformed streams to the in_syslog TCP/TLS endpoint, an attacker can rapidly exhaust system memory. This results in the operating system killing the Fluentd worker process (OOM Killer), leading to dropped logs, service outages, and severe backpressure to upstream systems.