Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the in_opentelemetry component of the fluent-plugin-opentelemetry plugin, which failed to limit the size of incoming HTTP request bodies and their decompressed payloads. The analysis of the provided patch commit, ce6c1f2a7741592c8a79afbe75fded9e8ebfa92d, pinpoints the exact location of the vulnerability. The changes are concentrated in lib/fluent/plugin/opentelemetry/http_input_handler.rb.
The core of the vulnerability lies in the common method of the Fluent::Plugin::Opentelemetry::HttpInputHandler class. Before the patch, this method would read the entire request body into memory (body = req.body) and, if the content was gzipped, decompress it entirely in one go (body = Zlib::GzipReader.new(StringIO.new(body)).read). Neither of these operations had any size limits, making the service susceptible to memory exhaustion and a subsequent Denial of Service (DoS).
The patch rectifies this by introducing two new configuration options, body_size_limit and decompression_size_limit. It replaces the unsafe operations within the common method with calls to new, safer functions: read_body and decompress. These new functions read and decompress the data in chunks while continuously checking against the configured limits, thus preventing excessive memory allocation. Therefore, the common method is identified as the vulnerable function, as it contained the logic that processed malicious input without proper validation.
Fluent::Plugin::Opentelemetry::HttpInputHandler.commonlib/fluent/plugin/opentelemetry/http_input_handler.rb
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| fluent-plugin-opentelemetry | rubygems | <= 0.5.2 | 0.5.3 |