fluent-vulnerability_checker 1.0.1 → 1.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9b7b016592779771f517e36e82a0d21f7834bd39a856808765bbda9e5a3e090b
-  data.tar.gz: 104bfc90898a715a10723349b8049b7ac57e9221370d7d67258666d2b11f3b69
+  metadata.gz: 96e4204851a5608ae47199c15728b16f99f3b4cf49bbe6c5ea15610a63f84993
+  data.tar.gz: 6847a3517038edaf8490bbc09acd32e99c164c610eac5629fcebd8fb6ebad254
 SHA512:
-  metadata.gz: f657e1541199274621a99060deae71440be81f8011d02519010eb8a3276956e26b85bf63a25458f0668f7f4f507a5b5059c3dab9ee78d043676c9d5e25b2c7f5
-  data.tar.gz: 14d93635f7c948b18826be70c30a6955a9ed6be8f68e11e7b77e58065ce055b92ba67032f228695c13e4bf4d6d4d525321202d7cc83a9cb28577ebce0388f287
+  metadata.gz: 2e30a73a70ccc10fd8f22dcaabdf51180dc3280bba3c7490761da659bc4b035b61994682542986bd387d163d2640fd8a4884c7a48efc9ab3d35e2280c75d693f
+  data.tar.gz: 072174336f375fcae7209fe7e71daf436fc94563c05c65d81308fe89365c52570be6e39d33d4eca969c1bdd09faf111aae2712c755adc578f93bc42921823fe3

data/.github/dependabot.yml

@@ -4,3 +4,20 @@ updates:
     directory: '/'
     schedule:
       interval: 'monthly'
+    groups:
+      # PR: "Security update [package] from [old] to [new]"
+      # This PR should be merged in hurry
+      security-updates:
+        applies-to: security-updates
+        patterns:
+          - '*'
+
+      # PR: "Bump [package] from [old] to [new]"
+      # No need to be merged this PR in hurry. It is enough to merge
+      # once in a month.
+      monthly-updates:
+        applies-to: version-updates
+        patterns:
+          - '*'
+    # Allow to create PR both of security and normal updates.
+    open-pull-requests-limit: 1

data/.github/workflows/linux.yml

@@ -25,8 +25,8 @@ jobs:
           - ubuntu-latest
     name: Ruby ${{ matrix.ruby }} unit testing on ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-    - uses: ruby/setup-ruby@6ca151fd1bfcfd6fe0c4eb6837eb0584d0134a0c # v1.290.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
       with:
         ruby-version: ${{ matrix.ruby }}
         rubygems: latest

data/.github/workflows/windows.yml

@@ -25,8 +25,8 @@ jobs:
           - windows-latest
     name: Ruby ${{ matrix.ruby }} unit testing on ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-    - uses: ruby/setup-ruby@6ca151fd1bfcfd6fe0c4eb6837eb0584d0134a0c # v1.290.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
       with:
         ruby-version: ${{ matrix.ruby }}
         rubygems: latest

data/README.md

@@ -11,6 +11,10 @@ Detects configurations leading to the following vulnerabilities:
 * CVE-2026-44161 [Server-Side Request Forgery (SSRF)](https://github.com/fluent/fluentd/security/advisories/GHSA-72f5-rr8c-r6gr)
 * CVE-2026-44160 [Denial of Service (DoS)](https://github.com/fluent/fluentd/security/advisories/GHSA-j9cw-hwqf-85w7)
 * CVE-2026-44025 [Exposure of Sensitive Information](https://github.com/fluent/fluentd/security/advisories/GHSA-pr7j-96cj-549h)
+* [Incomplete Fix for CVE-2026-44024: Path Traversal Bypass via Bare .. Tag in Output Plugins](https://github.com/fluent/fluentd/security/advisories/GHSA-5hq3-r276-rfr5)
+* [Out-of-Memory DoS via Object Allocation Amplification in in_http ndjson parsing](https://github.com/fluent/fluentd/security/advisories/GHSA-g69w-f42r-xp35)
+* [Out-of-Memory DoS via Unbounded TCP/TLS Connection Buffer in in_syslog](https://github.com/fluent/fluentd/security/advisories/GHSA-h3xv-5jpx-r4j2)
+* [Incomplete Fix for CVE-2026-44160: DoS via Unbounded Decompression in Buffer Chunk Streaming](https://github.com/fluent/fluentd/security/advisories/GHSA-x455-r5cg-h9p9)
 
 ## Installation
 Install the gem by executing:

data/lib/fluent/vulnerability_checker/messages.yaml

@@ -0,0 +1,183 @@
+# Message catalog for the vulnerabilities this tool detects.
+#
+# Each key should be the CVE ID of the advisory.
+---
+CVE-2026-44024:
+  title: Remote Code Execution (RCE) via Arbitrary File Write in Dynamic Placeholder
+  severity: Critical
+  cvss: 10.0
+  description:
+    en: |
+      If the ${tag} placeholder is used in a file path parameter of the file or secondary_file output plugin,
+      there is a risk that an attacker could write files to arbitrary paths, potentially leading to RCE.
+    ja: |
+      ファイルの出力先パスでプレースホルダーにtagを指定している場合、設定ファイルの書き方や実行権限が不適切だと、
+      任意のパスにファイルを書き込まれ、リモートからコード実行可能になる危険があります。
+  workaround:
+    en: |
+      If you cannot immediately update the package, apply mitigations such as restricting access,
+      running with non-root privileges, modifying the configuration file, or removing untrusted tags.
+    ja: |
+      すぐにパッケージを更新できない場合、アクセスの制限、非root権限での実行、設定ファイルの修正、信頼できない
+      tagを除去するなどの緩和策を適用してください。
+
+CVE-2026-44025:
+  title: Exposure of Sensitive Information via Monitor Agent API
+  severity: High
+  cvss: 7.5
+  note: |
+    (Note: In Fluentd 1.19.2 and earlier, the default value of bind is 0.0.0.0.)
+  description:
+    en: |
+      monitor_agent is exposed externally, allowing attackers to read Fluentd configuration details via its API.
+    ja: |
+      monitor_agentによって公開されているAPIを悪用して、Fluentdの設定内容を読み取られる危険性があります。
+  workaround:
+    en: |
+      If you cannot immediately update the package, apply mitigations such as restricting access,
+      or allowing access only from localhost.
+    ja: |
+      すぐにパッケージを更新できない場合、アクセスの制限、ローカルホストからのみのアクセスを受け付けるなどの
+      緩和策を適用してください。
+
+CVE-2026-44160:
+  title: Denial of Service (DoS) via Gzip Decompression Bomb
+  severity: High
+  cvss: 7.5
+  description:
+    en: |
+      Sending maliciously crafted gzip-compressed data to Fluentd can consume excessive memory during
+      decompression, potentially causing it to crash.
+    ja: |
+      細工したgzip圧縮データをFluentdへと送りつけることで、展開時に大量のメモリを消費させてFluentdをクラッシュ
+      する危険性があります。
+  workaround:
+    en: |
+      If you cannot immediately update the package, apply mitigations such as restricting access, or enforcing
+      size limits when decompressing content using a reverse proxy.
+    ja: |
+      すぐにパッケージを更新できない場合、アクセスの制限、リバースプロキシ等を用いたGZIP展開時のサイズ制限等の
+      緩和策を適用してください。
+
+CVE-2026-44161:
+  title: Server-Side Request Forgery (SSRF) via Placeholder Expansion in out_http
+  severity: Moderate
+  cvss: 5.8
+  description:
+    en: |
+      When out_http determines destination servers for data transmission based on tags, this vulnerability
+      allows attackers to manipulate data transmission by sending crafted data, resulting in data being sent
+      to servers other than the intended ones.
+    ja: |
+      out_httpでデータを別のサーバーに送る際の送信先をタグから決定している場合、細工したデータを送りつけられると、
+      本来の意図とは異なるサーバーへとデータを送信してしまうことが可能な脆弱性です。
+  workaround:
+    en: |
+      If you cannot immediately update the package, apply mitigation measures such as:
+      * not dynamically setting hostnames with placeholders
+      * restricting access from untrusted networks
+      * allowing only specific hosts
+    ja: |
+      すぐにパッケージを更新できない場合、プレースホルダーでホスト名を動的に設定しない、信頼できない
+      ネットワークからのアクセスの制限、特定のホストのみ許可するなどの緩和策を適用してください。
+
+CVE-2026-44162:
+  title: Denial of Service (DoS) via Gzip Decompression Bomb
+  severity: Low
+  cvss: 2.7
+  description:
+    en: |
+      Sending maliciously crafted gzip-compressed data from S3 to Fluentd can consume excessive memory when
+      processing requests, potentially causing it to crash.
+    ja: |
+      細工したgzip圧縮データをS3から受信することで、展開時に大量のメモリを消費してFluentdがクラッシュする
+      危険性があります。
+  workaround:
+    en: |
+      If you cannot immediately update the package, apply mitigations such as restricting access, or enforcing
+      size limits when decompressing content using a reverse proxy.
+    ja: |
+      すぐにパッケージを更新できない場合、アクセスの制限、リバースプロキシ等を用いたGZIP展開時のサイズ制限等の
+      緩和策を適用してください。
+
+CVE-2026-44163:
+  title: Denial of Service (DoS) via Gzip Decompression Bomb or Malicious HTTP Requests
+  severity: Moderate
+  cvss: 5.3
+  description:
+    en: |
+      Sending maliciously crafted gzip-compressed data to Fluentd can consume excessive memory when processing
+      requests, potentially causing it to crash.
+    ja: |
+      細工したgzip圧縮データやHTTPリクエストを受信することで、リクエスト処理時に大量のメモリを消費してFluentdが
+      クラッシュする危険性があります。
+  workaround:
+    en: |
+      If you cannot immediately update the package, apply mitigations such as restricting access, or enforcing
+      size limits when processing requests using a reverse proxy.
+    ja: |
+      すぐにパッケージを更新できない場合、アクセスの制限、リバースプロキシ等を用いたリクエストサイズ制限等の
+      緩和策を適用してください。
+
+CVE-2026-IN_HTTP_OOM:
+  title: Out-of-Memory DoS via Object Allocation Amplification in `in_http` ndjson parsing
+  severity: High
+  cvss: 7.5
+  description:
+    en: |
+      Out-of-Memory DoS via Object Allocation Amplification in `in_http` ndjson parsing
+    ja: |
+      in_syslogのndjsonのパースに不備があり、OOM由来のサービス拒否(DoS)につながる脆弱性があります
+  workaround:
+    en: |
+      If you cannot immediately update the package, apply mitigation measures such as:
+        * Restrict network access for `in_http`, allow connection within a closed, trusted network.
+        * Implement reverse proxy limits with forcing strict rate limiting and request
+        size limits at the proxy layer to drop anomalous requests before they reach the Fluentd worker.
+    ja: |
+      すぐに更新できない場合、次のような緩和策を検討してください。
+      * in_httpの9880ポートへのアクセスを受け付ける送信元IPをファイアウォール等で制限する
+      * Reverse proxyを間に挟み、クライアントのタイムアウトを厳密に管理したり、
+      バッファーサイズが異常なFluentdへのリクエストを遮断する
+
+CVE-2026-IN_SYSLOG_DOS:
+  title: Out-of-Memory DoS via Unbounded TCP/TLS Connection Buffer in in_syslog
+  severity: High
+  cvss: 7.5
+  description:
+    en: |
+      Out-of-Memory DoS via Unbounded TCP/TLS Connection Buffer in in_syslog
+    ja: |
+      in_syslogのTCP/TLS接続を受け付けていると、OOM由来でサービス拒否(DoS)につながる脆弱性があります
+  workaround:
+    en: |
+      If you cannot immediately update the package, apply mitigation measures such as:
+      * Restrict network access for in_syslog, allow connection within a closed, trusted network.
+      * Switch to UDP Transport for a while.
+    ja: |
+      すぐに更新できない場合、次のような緩和策を検討してください。
+      * in_syslogの5140ポートへのアクセスを受け付ける送信元IPをファイアウォール等で制限する
+      * TCP/TLSではなく、問題が解決するまで一時的にUDP <transport udp>に置きかえる
+      * Reverse proxyを間に挟み、クライアントのタイムアウトを厳密に管理したり、
+      バッファーサイズが異常なFluentdへのリクエストを遮断する
+
+CVE-2026-BUFFER_FILE_UNBOUNDED_DECOMPRESSION:
+  title: "Incomplete Fix for CVE-2026-44160: DoS via Unbounded Decompression in Buffer Chunk Streaming"
+  severity: Low
+  cvss: 2.9
+  description:
+    en: |
+      DoS via unbounded decompression in buffer chunk streaming. Expanding buffer might cause Out-of-Memory.
+    ja: |
+      圧縮されたバッファの扱いに不備があり、バッファ展開時にOut-of-Memory由来のサービス拒否(DoS)につながる脆弱性です。
+  workaround:
+    en: |
+      If you cannot immediately update the package, apply mitigation measures such as:
+      * Disable Buffer Compression for a while
+      * Disable automatic chunk backup with `disaable_chunk_backup`.
+      * Restrict network access only from closed, trusted network.
+    ja: |
+      すぐにパッケージを更新できない場合次のような緩和策を検討してください。
+      * <buffer>セクションのcompress gzipやcompress zstdを使わない。ただし、ディスク使用量が増えるデメリットがあります
+      * `disable_chunk_backup true`をアウトプットプラグインに指定して不正なチャンクのバックアップを無効化する
+      * `in_http`や`in_forward`といったインプットプラグインへのアクセスを信頼できる送信元のみに制限する

data/lib/fluent/vulnerability_checker.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'yaml'
+
 require 'fluent/config'
 require 'fluent/env'
 
@@ -7,21 +9,25 @@ module Fluent
   class VulnerabilityChecker
     CHUNK_ID_PLACEHOLDER_PATTERN = /\$\{chunk_id\}/
     PLACEHOLDER_PATTERN = /\$\{.*?\}/
+    MESSAGES_PATH = File.join(__dir__, 'vulnerability_checker', 'messages.yaml')
 
     class Rule
-      def initialize(plugin_categories, plugin_name = nil, &condition_proc)
+      attr_reader :cve
+
+      def initialize(cve, plugin_categories, plugin_name = nil, &condition_proc)
+        @cve = cve
         @plugin_categories = Array(plugin_categories)
         @plugin_name = plugin_name
         @condition_proc = condition_proc
       end
 
-      def register_report_message(&report_proc)
-        @report_proc = report_proc
+      def register_state_message(&state_proc)
+        @state_proc = state_proc
         self
       end
 
-      def report(element)
-        @report_proc&.call(element)
+      def state(element)
+        @state_proc&.call(element)
       end
 
       def safe?(element)
@@ -33,184 +39,132 @@ module Fluent
       end
     end
 
+    class Report
+      # Width of the "* State:      " label. Continuation lines are aligned with it.
+      STATE_INDENT = ' ' * 14
+      # Width of the "  * EN: " label.
+      TEXT_INDENT = ' ' * 8
+
+      def initialize(messages_path = MESSAGES_PATH)
+        @messages = YAML.load_file(messages_path)
+      end
+
+      def render(rule, element)
+        message = @messages.fetch(rule.cve)
+        state = rule.state(element)
+
+        lines = [
+          "# #{message['title']}",
+          "* Severity:   #{message['severity']}",
+          "* CVSS Score: #{message['cvss']}",
+          "* Location:   <#{element.name}> - @type #{element['@type']}"
+        ]
+        if state
+          lines << "* State:      #{state}"
+          lines << "#{STATE_INDENT}#{align(message['note'], STATE_INDENT)}" if message['note']
+        end
+        lines << '* Description:'
+        lines.concat(bilingual(message['description']))
+        lines << '* Workaround:'
+        lines.concat(bilingual(message['workaround']))
+        lines.join("\n")
+      end
+
+      private
+
+      def bilingual(texts)
+        ['en', 'ja'].map { |lang| "  * #{lang.upcase}: #{align(texts.fetch(lang), TEXT_INDENT)}" }
+      end
+
+      def align(text, indent)
+        text.strip.gsub("\n", "\n#{indent}")
+      end
+    end
+
     attr_reader :vulnerabilities # for test
 
     def initialize
       @vulnerabilities = 0
+      @report = Report.new
       @rules = []
 
       # Fluentd: RCE via ${tag} in file in output/buffer/secondary/store sections
-      @rules << Rule.new(['match', 'buffer', 'secondary', 'store'], 'file') { |element|
+      @rules << Rule.new('CVE-2026-44024', ['match', 'buffer', 'secondary', 'store'], 'file') { |element|
         # replace the safe ${chunk_id} with an empty string to clear it, and check if the remaining string contains ${...}
         element['path']&.gsub(CHUNK_ID_PLACEHOLDER_PATTERN, '')&.match?(PLACEHOLDER_PATTERN)
-      }.register_report_message do |element|
-        <<~"MSG"
-          # Remote Code Execution (RCE) via Arbitrary File Write in Dynamic Placeholder
-          * Severity:   Critical
-          * CVSS Score: 10.0
-          * Location:   <#{element.name}> - @type #{element['@type']}
-          * State:      path = '#{element['path']}'
-          * Description:
-            * EN: If the ${tag} placeholder is used in the path parameter of the file output plugin, there is a risk that
-                  an attacker could write files to arbitrary paths, potentially leading to RCE.
-            * JA: pathでプレースホルダーにtagを指定している場合、設定ファイルの書き方や実行権限が不適切だと、任意のパスに
-                  ファイルを書き込まれ、リモートからコード実行可能になる危険があります。
-          * Workaround:
-            * EN: If you cannot immediately update the package, apply mitigations such as restricting access,
-                  running with non-root privileges, modifying the configuration file, or removing untrusted tags.
-            * JA: すぐにパッケージを更新できない場合、アクセスの制限、非root権限での実行、設定ファイルの修正、信頼できない
-                  tagを除去するなどの緩和策を適用してください。
-        MSG
-      end
+      }.register_state_message { |element| "path = '#{element['path']}'" }
 
       # Fluentd: RCE via ${tag} in secondary_file
-      @rules << Rule.new('secondary', 'secondary_file') { |element|
+      @rules << Rule.new('CVE-2026-44024', 'secondary', 'secondary_file') { |element|
         # replace the safe ${chunk_id} with an empty string to clear it, and check if the remaining string contains ${...}
         element['directory']&.gsub(CHUNK_ID_PLACEHOLDER_PATTERN, '')&.match?(PLACEHOLDER_PATTERN) ||
           element['basename']&.gsub(CHUNK_ID_PLACEHOLDER_PATTERN, '')&.match?(PLACEHOLDER_PATTERN)
-      }.register_report_message do |element|
-        state_msg = ['directory', 'basename'].map { |k| "#{k} = '#{element[k]}'" if element[k]&.match?(PLACEHOLDER_PATTERN) }.compact.join(', ')
-        <<~"MSG"
-          # Remote Code Execution (RCE) via Arbitrary File Write in Dynamic Placeholder
-          * Severity:   Critical
-          * CVSS Score: 10.0
-          * Location:   <#{element.name}> - @type #{element['@type']}
-          * State:      #{state_msg}
-          * Description:
-            * EN: If the ${tag} placeholder is used in the directory or basename parameter of the secondary_file plugin, 
-                  there is a risk that an attacker could write files to arbitrary paths, potentially leading to RCE.
-            * JA: directoryまたはbasenameでプレースホルダーにtagを指定している場合、設定ファイルの書き方や実行権限が不適切だと、任意のパスに
-                  ファイルを書き込まれ、リモートからコード実行可能になる危険があります。
-          * Workaround:
-            * EN: If you cannot immediately update the package, apply mitigations such as restricting access,
-                  running with non-root privileges, modifying the configuration file, or removing untrusted tags.
-            * JA: すぐにパッケージを更新できない場合、アクセスの制限、非root権限での実行、設定ファイルの修正、信頼できない
-                  tagを除去するなどの緩和策を適用してください。
-        MSG
+      }.register_state_message do |element|
+        ['directory', 'basename'].map { |k| "#{k} = '#{element[k]}'" if element[k]&.match?(PLACEHOLDER_PATTERN) }.compact.join(', ')
       end
 
       # Fluentd: Exposure of Sensitive Information
-      @rules << Rule.new('source', 'monitor_agent') { |element| element['bind'].nil? || element['bind'] == '0.0.0.0' }.register_report_message do |element|
-        <<~"MSG"
-          # Exposure of Sensitive Information via Monitor Agent API
-          * Severity:   High
-          * CVSS Score: 7.5
-          * Location:   <#{element.name}> - @type #{element['@type']}
-          * State:      bind = '#{element['bind'] || 'default'}'.
-                        (Note: In Fluentd 1.19.2 and earlier, the default value of bind is 0.0.0.0.)
-          * Description:
-            * EN: monitor_agent is exposed externally, allowing attackers to read Fluentd configuration details via its API.
-            * JA: monitor_agentによって公開されているAPIを悪用して、Fluentdの設定内容を読み取られる危険性があります。
-          * Workaround:
-            * EN: If you cannot immediately update the package, apply mitigations such as restricting access,
-                  or allowing access only from localhost.
-            * JA: すぐにパッケージを更新できない場合、アクセスの制限、ローカルホストからのみのアクセスを受け付けるなどの
-                  緩和策を適用してください。
-        MSG
-      end
+      @rules << Rule.new('CVE-2026-44025', 'source', 'monitor_agent') { |element|
+        element['bind'].nil? || element['bind'] == '0.0.0.0'
+      }.register_state_message { |element| "bind = '#{element['bind'] || 'default'}'." }
+
+      # "Incomplete Fix for CVE-2026-44024: Path Traversal Bypass via Bare `..` Tag in Output Plugins"
+      # That should be covered above cases. (https://github.com/fluent/fluentd/security/advisories/GHSA-5hq3-r276-rfr5)
 
       # Fluentd: DoS via Gzip Decompression in http input plugin
-      @rules << Rule.new('source', 'http') { |element| true }.register_report_message do |element|
-        <<~"MSG"
-          # Denial of Service (DoS) via Gzip Decompression Bomb
-          * Severity:   High
-          * CVSS Score: 7.5
-          * Location:   <#{element.name}> - @type #{element['@type']}
-          * Description:
-            * EN: Sending maliciously crafted gzip-compressed data to Fluentd can consume excessive memory during
-                  decompression, potentially causing it to crash.
-            * JA: 細工したgzip圧縮データをFluentdへと送りつけることで、展開時に大量のメモリを消費させてFluentdをクラッシュ
-                  する危険性があります。
-          * Workaround:
-            * EN: If you cannot immediately update the package, apply mitigations such as restricting access, or enforcing
-                  size limits when decompressing content using a reverse proxy.
-            * JA: すぐにパッケージを更新できない場合、アクセスの制限、リバースプロキシ等を用いたGZIP展開時のサイズ制限等の
-                  緩和策を適用してください。
-        MSG
-      end
+      @rules << Rule.new('CVE-2026-44160', 'source', 'http') { |element| true }
 
       # Fluentd: DoS via Gzip Decompression in forward input plugin
-      @rules << Rule.new('source', 'forward') { |element| true }.register_report_message do |element|
-        <<~"MSG"
-          # Denial of Service (DoS) via Gzip Decompression Bomb
-          * Severity:   High
-          * CVSS Score: 7.5
-          * Location:   <#{element.name}> - @type #{element['@type']}
-          * Description:
-            * EN: Sending maliciously crafted gzip-compressed data to Fluentd can consume excessive memory during
-                  decompression, potentially causing it to crash.
-            * JA: 細工したgzip圧縮データを受信することで、展開時に大量のメモリを消費してFluentdがクラッシュする危険性が
-                  あります。
-          * Workaround:
-            * EN: If you cannot immediately update the package, apply mitigations such as restricting access, or enforcing
-                  size limits when decompressing content using a reverse proxy.
-            * JA: すぐにパッケージを更新できない場合、アクセスの制限、リバースプロキシ等を用いたGZIP展開時のサイズ制限等の
-                  緩和策を適用してください。
-        MSG
-      end
+      @rules << Rule.new('CVE-2026-44160', 'source', 'forward') { |element| true }
 
       # fluent-plugin-s3: DoS via Gzip Decompression
-      @rules << Rule.new('source', 's3') { |element| true }.register_report_message do |element|
-        <<~"MSG"
-          # Denial of Service (DoS) via Gzip Decompression Bomb
-          * Severity:   Low
-          * CVSS Score: 2.7
-          * Location:   <#{element.name}> - @type #{element['@type']}
-          * Description:
-            * EN: Sending maliciously crafted gzip-compressed data from S3 to Fluentd can consume excessive memory when
-                  processing requests, potentially causing it to crash.
-            * JA: 細工したgzip圧縮データをS3から受信することで、展開時に大量のメモリを消費してFluentdがクラッシュする
-                  危険性があります。
-          * Workaround:
-            * EN: If you cannot immediately update the package, apply mitigations such as restricting access, or enforcing
-                  size limits when decompressing content using a reverse proxy.
-            * JA: すぐにパッケージを更新できない場合、アクセスの制限、リバースプロキシ等を用いたGZIP展開時のサイズ制限等の
-                  緩和策を適用してください。
-        MSG
-      end
+      @rules << Rule.new('CVE-2026-44162', 'source', 's3') { |element| true }
 
       # fluent-plugin-opentelemetry: DoS
-      @rules << Rule.new('source', 'opentelemetry') { |element| true }.register_report_message do |element|
-        <<~"MSG"
-          # Denial of Service (DoS) via Gzip Decompression Bomb or Malicious HTTP Requests
-          * Severity:   Moderate
-          * CVSS Score: 5.3
-          * Location:   <#{element.name}> - @type #{element['@type']}
-          * Description:
-            * EN: Sending maliciously crafted gzip-compressed data to Fluentd can consume excessive memory when processing
-                  requests, potentially causing it to crash.
-            * JA: 細工したgzip圧縮データやHTTPリクエストを受信することで、リクエスト処理時に大量のメモリを消費してFluentdが
-                  クラッシュする危険性があります。
-          * Workaround:
-            * EN: If you cannot immediately update the package, apply mitigations such as restricting access, or enforcing
-                  size limits when processing requests using a reverse proxy.
-            * JA: すぐにパッケージを更新できない場合、アクセスの制限、リバースプロキシ等を用いたリクエストサイズ制限等の
-                  緩和策を適用してください。
-        MSG
-      end
+      @rules << Rule.new('CVE-2026-44163', 'source', 'opentelemetry') { |element| true }
 
       # Fluentd: SSRF via ${endpoint} in http output plugin
-      @rules << Rule.new('match', 'http') { |element| element['endpoint']&.match?(%r[https?://[^/]*\$\{]) }.register_report_message do |element|
-        <<~"MSG"
-          # Server-Side Request Forgery (SSRF) via Placeholder Expansion in out_http
-          * Severity:   Moderate
-          * CVSS Score: 5.8
-          * Location:   <#{element.name}> - @type #{element['@type']}
-          * Description:
-            * EN: When out_http determines destination servers for data transmission based on tags, this vulnerability
-                  allows attackers to manipulate data transmission by sending crafted data, resulting in data being sent
-                  to servers other than the intended ones.
-            * JA: out_httpでデータを別のサーバーに送る際の送信先をタグから決定している場合、細工したデータを送りつけられると、
-                  本来の意図とは異なるサーバーへとデータを送信してしまうことが可能な脆弱性です。
-          * Workaround:
-            * EN: If you cannot immediately update the package, apply mitigation measures such as:
-                  * not dynamically setting hostnames with placeholders
-                  * restricting access from untrusted networks
-                  * allowing only specific hosts
-            * JA: すぐにパッケージを更新できない場合、プレースホルダーでホスト名を動的に設定しない、信頼できない
-                  ネットワークからのアクセスの制限、特定のホストのみ許可するなどの緩和策を適用してください。
-        MSG
-      end
+      @rules << Rule.new('CVE-2026-44161', 'match', 'http') { |element|
+        element['endpoint']&.match?(%r[https?://[^/]*\$\{])
+      }
+
+      # Out-of-Memory DoS via Object Allocation Amplification in `in_http` ndjson parsing
+      @rules << Rule.new('CVE-2026-IN_HTTP_OOM', 'source', 'http') { |element|
+        (
+          element['@type'] == 'http' && (
+            # no <auth> or <security>
+            (element['message_length_limit'] && element.elements.empty?) ||
+            # <auth> or <security>
+            element.elements.any? { |v| %w[auth security].include?(v.name) })
+        )
+      }
+
+      # Out-of-Memory DoS via Unbounded TCP/TLS Connection Buffer in in_syslog
+      @rules << Rule.new('CVE-2026-IN_SYSLOG_DOS', 'source', 'syslog') { |element|
+        element['@type'] == 'syslog' && (
+          # no transport section
+          element.elements.empty? ||
+          # <transport udp> is safe
+          element.elements&.any? { |v| v.name == 'transport' && %w[tcp tls].include?(v.arg) }
+        )
+      }
+
+      # DoS via Unbounded Decompression in Buffer Chunk Streaming
+      @rules << Rule.new('CVE-2026-BUFFER_FILE_UNBOUNDED_DECOMPRESSION', 'match', 'file') { |element|
+        # compress in <match> section
+        element['@type'] == 'file' && %w[gzip zstd].include?(element['compress'])
+      }
+
+      @rules << Rule.new('CVE-2026-BUFFER_FILE_UNBOUNDED_DECOMPRESSION', 'buffer', 'file') { |element|
+        # compress in <match> section
+        element['@type'] == 'file' && %w[gzip zstd].include?(element['compress'])
+      }
+
+      # DoS via Unbounded Decompression in Buffer Chunk Streaming
+      @rules << Rule.new('CVE-2026-BUFFER_FILE_UNBOUNDED_DECOMPRESSION', 'buffer', 'file_single') { |element|
+        # compress in <buffer> section
+        element['@type'] == 'file_single' && %w[gzip zstd].include?(element['compress'])
+      }
     end
 
     def validate(config_path)
@@ -227,7 +181,7 @@ module Fluent
       @rules.each do |rule|
         unless rule.safe?(element)
           @vulnerabilities += 1
-          puts rule.report(element)
+          puts @report.render(rule, element)
           puts "=" * 115
         end
       end

data/test/fluent/resources/unsafe/dos_in_out_file_buffer_compress_gzip.conf

@@ -0,0 +1,7 @@
+<match>
+  @type file
+  <buffer tag>
+    @type file
+    compress gzip
+  </buffer>
+</match>

data/test/fluent/resources/unsafe/dos_in_out_file_buffer_compress_zstd.conf

@@ -0,0 +1,7 @@
+<match>
+  @type file
+  <buffer tag>
+    @type file
+    compress gzip
+  </buffer>
+</match>

data/test/fluent/resources/unsafe/dos_in_out_file_compress_gzip.conf

@@ -0,0 +1,4 @@
+<match>
+  @type file
+  compress gzip
+</match>

data/test/fluent/resources/unsafe/dos_in_out_file_compress_zstd.conf

@@ -0,0 +1,4 @@
+<match>
+  @type file
+  compress zstd
+</match>

data/test/fluent/resources/unsafe/dos_in_out_file_single_buffer_compress_gzip.conf

@@ -0,0 +1,7 @@
+<match>
+  @type file
+  <buffer tag>
+    @type file_single
+    compress gzip
+  </buffer>
+</match>

data/test/fluent/resources/unsafe/dos_in_out_file_single_buffer_compress_zstd.conf

@@ -0,0 +1,7 @@
+<match>
+  @type file
+  <buffer tag>
+    @type file_single
+    compress gzip
+  </buffer>
+</match>

data/test/fluent/resources/unsafe/oom_in_http_ndjson.conf

@@ -0,0 +1,4 @@
+<source>
+  @type http
+  message_length_limit 4096
+</source>

data/test/fluent/resources/unsafe/oom_in_syslog.conf

@@ -0,0 +1,3 @@
+<source>
+  @type syslog
+</source>

data/test/fluent/resources/unsafe/oom_in_syslog_tcp.conf

@@ -0,0 +1,5 @@
+<source>
+  @type syslog
+  <transport tcp>
+  </transport>
+</source>

data/test/fluent/test_vulnerability_checker.rb

@@ -138,4 +138,42 @@ class Fluent::VulnerabilityCheckerTest < Test::Unit::TestCase
 
     assert_equal(3, checker.vulnerabilities)
   end
+
+  sub_test_case "Out-of-Memory DoS via Object Allocation Amplification in `in_http` ndjson parsing" do
+    test "Recommend to use <auth> section" do
+      config_path = path("./resources/unsafe/oom_in_http_ndjson.conf")
+      checker = Fluent::VulnerabilityChecker.new
+      checker.validate(config_path)
+      # CVE-2026-44160 is also detected here
+      assert_equal(2, checker.vulnerabilities)
+    end
+  end
+
+  sub_test_case "Out-of-Memory DoS via Unbounded TCP/TLS Connection Buffer in `in_syslog`" do
+    data("no transport" => "./resources/unsafe/oom_in_syslog.conf",
+         "udp transport" =>"./resources/unsafe/oom_in_syslog_tcp.conf")
+    test "Recommend to use <auth> section" do (data)
+      config_path = path(data)
+      checker = Fluent::VulnerabilityChecker.new
+      checker.validate(config_path)
+
+      assert_equal(1, checker.vulnerabilities)
+    end
+  end
+
+  sub_test_case "DoS via Unbounded Decompression in Buffer Chunk Streaming" do
+    data("compress gzip (traditional)" => "./resources/unsafe/dos_in_out_file_compress_gzip.conf",
+         "compress zstd (traditional)" => "./resources/unsafe/dos_in_out_file_compress_zstd.conf",
+         "buffer compress gzip" => "./resources/unsafe/dos_in_out_file_buffer_compress_gzip.conf",
+         "buffer compress zstd" => "./resources/unsafe/dos_in_out_file_buffer_compress_zstd.conf",
+         "file_single buffer compress gzip" => "./resources/unsafe/dos_in_out_file_single_buffer_compress_gzip.conf",
+         "file_single buffer compress zstd" => "./resources/unsafe/dos_in_out_file_single_buffer_compress_zstd.conf")
+    test "Recommend to disable buffer commpression" do (data)
+      config_path = path(data)
+      checker = Fluent::VulnerabilityChecker.new
+      checker.validate(config_path)
+
+      assert_equal(1, checker.vulnerabilities)
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fluent-vulnerability_checker
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.0.3
 platform: ruby
 authors:
 - Shizuo Fujita
@@ -41,14 +41,24 @@ files:
 - Rakefile
 - exe/fluent-vulnerabilitycheck
 - lib/fluent/vulnerability_checker.rb
+- lib/fluent/vulnerability_checker/messages.yaml
 - test/fluent/resources/safe/in_monitor_agent.conf
 - test/fluent/resources/safe/out_file_buffer_file.conf
 - test/fluent/resources/safe/out_http.conf
 - test/fluent/resources/unsafe/dos_in_forward.conf
 - test/fluent/resources/unsafe/dos_in_http.conf
 - test/fluent/resources/unsafe/dos_in_opentelemetry.conf
+- test/fluent/resources/unsafe/dos_in_out_file_buffer_compress_gzip.conf
+- test/fluent/resources/unsafe/dos_in_out_file_buffer_compress_zstd.conf
+- test/fluent/resources/unsafe/dos_in_out_file_compress_gzip.conf
+- test/fluent/resources/unsafe/dos_in_out_file_compress_zstd.conf
+- test/fluent/resources/unsafe/dos_in_out_file_single_buffer_compress_gzip.conf
+- test/fluent/resources/unsafe/dos_in_out_file_single_buffer_compress_zstd.conf
 - test/fluent/resources/unsafe/dos_in_s3.conf
 - test/fluent/resources/unsafe/exposure_of_sensitive_information.conf
+- test/fluent/resources/unsafe/oom_in_http_ndjson.conf
+- test/fluent/resources/unsafe/oom_in_syslog.conf
+- test/fluent/resources/unsafe/oom_in_syslog_tcp.conf
 - test/fluent/resources/unsafe/remote_code_execution_buffer_file.conf
 - test/fluent/resources/unsafe/remote_code_execution_out_file.conf
 - test/fluent/resources/unsafe/remote_code_execution_out_secondary_file.conf
@@ -58,7 +68,8 @@ files:
 - test/fluent/resources/unsafe/test_vulnerable.yaml
 - test/fluent/test_vulnerability_checker.rb
 homepage: https://github.com/clear-code/fluent-vulnerability_checker
-licenses: []
+licenses:
+- Apache-2.0
 metadata:
   homepage_uri: https://github.com/clear-code/fluent-vulnerability_checker
   source_code_uri: https://github.com/clear-code/fluent-vulnerability_checker
@@ -77,7 +88,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.15
+rubygems_version: 3.6.9
 specification_version: 4
 summary: A security scanner and vulnerability checker for Fluentd configuration files.
 test_files: []