CVE-2021-41186

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. This issue is patched in version 1.14.2 There are two workarounds available. Either don't use parser_apache2 for parsing logs (which cannot guarantee generated by Apache), or put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable `FLUENT_PLUGIN` or `--plugin` option of fluentd).

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Oct 29, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-411878.8DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerabilitCVE-2021-411885.4Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in CVE-2021-411897.2DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permisCVE-2021-41199.8bookstack is vulnerable to Improper Access ControlCVE-2021-411905.0The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI DistributionCVE-2021-411917.5Roblox-Purchasing-Hub is an open source Roblox product purchasing hub. A security risk in versions 1.0.1 and prior allowed people who have sCVE-2021-411926.5Redash is a package for data visualization and sharing. If an admin sets up Redash versions 10.0.0 and prior without explicitly specifying tCVE-2021-411939.8wire-avs is the audio visual signaling (AVS) component of Wire, an open-source messenger. A remote format string vulnerability in versions pCVE-2021-411949.8FirstUseAuthenticator is a JupyterHub authenticator that helps new users set their password on their first login to JupyterHub. When JupyterCVE-2021-411955.5TensorFlow is an open source platform for machine learning. In affected versions the implementation of `tf.math.segment_*` operations resultCVE-2021-411965.5TensorFlow is an open source platform for machine learning. In affected versions the Keras pooling layers can trigger a segfault if the sizeCVE-2021-411975.5TensorFlow is an open source platform for machine learning. In affected versions TensorFlow allows tensor to have a large number of dimensio
CVE-2021-41186: High severity, CVSS 7.5 | Vulnix