Fluentd

v1.19.4Observability

Sep 28, 2026

A maintenance release centered on bug fixes, including a path-traversal security correction. It also changes the syslog message-size default and adds HTTP authentication and network allowlisting capabilities.

Action needed (2)

securityComplete path traversal checking in extract_placeholders
The output path traversal check in extract_placeholders now handles the previously incomplete case.
fluentd#5501
breakingDecompression size enforcement on the buffer chunk I/O path
The buffer chunk I/O path now enforces decompression_size_limit.
fluentd#5504

Check if affected (2)

breakingmessage_length_limit enforcement for syslog TCP and TLS transports
Applicability is not stated in the release notes.
The in_syslog plugin now enforces message_length_limit on TCP and TLS transports.
fluentd#5502
breakingThe message_length_limit default, increased to 8192
Applies if you do not configure message_length_limit.
The default message_length_limit changes from 2048 to 8192, matching rsyslog's default MaxMessageSize.

All 17 other recorded changesfixes 13 · additions 2 · constraints 1 · value changes 1

fixes (13)

* https://github.com/fluent/fluentd/pull/5488 buffer: clamp exported buffer size metrics to non-negative values
* https://github.com/fluent/fluentd/pull/5487 buffer: fix spurious BufferOverflowError caused by queue_size leaking when a chunk purge fails
* https://github.com/fluent/fluentd/pull/5456 buffer: fix stage_byte_size leak on staged to unstaged chunk demotion that could eventually raise spurious BufferOverflowError in plugins implementing #format
* https://github.com/fluent/fluentd/pull/5423 output: treat JSON::GeneratorError as unrecoverable error
* https://github.com/fluent/fluentd/pull/5500 parser_syslog: fix NameError when RFC5424 timestamp has repeated spaces
* https://github.com/fluent/fluentd/pull/5497 parser_syslog: fix NameError when RFC3164 timestamp has repeated spaces
* https://github.com/fluent/fluentd/pull/5444 parser_syslog: avoid excessive backtracking when parsing malformed RFC5424 structured data
* https://github.com/fluent/fluentd/pull/5486 chunk: ensure to close the Tempfile for decompressed data
* https://github.com/fluent/fluentd/pull/5471 plugin base: bound the number of worker lock files by hashing the path into a fixed set of buckets
* https://github.com/fluent/fluentd/pull/5445 out_forward: stop the endless "ack in response and chunk id in sent data are different" warning storm by discarding (instead of reusing) a keepalive socket whose ack failed or came back with a mismatched chunk id
* https://github.com/fluent/fluentd/pull/5478 config: accept empty lines in quoted strings
* https://github.com/fluent/fluentd/pull/5433 config: fix a config error when a single scalar value is given to an array option in YAML config syntax (for example retryable_response_codes: 503)
* https://github.com/fluent/fluentd/pull/5472 supervisor: reduce memory usage of cleanup_lock_dir with huge number of lock files

additions (2)

* https://github.com/fluent/fluentd/pull/5503 in_http: add <auth> for basic authentication and <security> for client network allowlisting
* https://github.com/fluent/fluentd/pull/5432 Add allow_comments: true option for json parser

constraints (1)

* https://github.com/fluent/fluentd/pull/5493 gem: support json gem v3.x

value changes (1)

* https://github.com/fluent/fluentd/pull/5430 Set allow_duplicate_key: true for all JSON.parse call

Add Fluentd to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →

Official release note ↗All Fluentd releases →