How severe is CVE-2022-39379?

CVE-2022-39379 has a CVSS 3.x base score of 3.1, rated low severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2022-39379 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 45% (99th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-39379?

CVE-2022-39379 primarily affects Fluentd. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2022-39379?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2022-39379 published?

CVE-2022-39379 was published on 2022-11-02 and last updated on 2026-06-17.

CVE-2022-39379

CVE-2022-39379 is a low-severity vulnerability in Fluentd with a CVSS 3.x base score of 3.1. Its EPSS exploit-prediction score of 45% places it in the 99th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-502.

Key facts

Severity: Low (CVSS 3.x base score 3.1)
EPSS exploit prediction: 45% (99th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-502
Affected product: Fluentd
Published: 2022-11-02
Last modified: 2026-06-17

Description

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.

Frequently asked questions

What is CVE-2022-39379?: Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.
How severe is CVE-2022-39379?: CVE-2022-39379 has a CVSS 3.x base score of 3.1, rated low severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2022-39379 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 45% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-39379?: CVE-2022-39379 primarily affects Fluentd. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2022-39379?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-39379 published?: CVE-2022-39379 was published on 2022-11-02 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:a:fluentd:fluentd:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

More vulnerabilities in Fluentd

CVE-2017-10906 — Critical (CVSS 9.8): Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the…
CVE-2020-21514 — High (CVSS 8.8): An issue was discovered in Fluent-ui v.1.2.2 allows attackers to gain escalated privileges and execute arbitrary code…
CVE-2021-41186 — Medium (CVSS 5.9): Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The…

All CVEs affecting Fluentd →

Other CWE-502 (Deserialization of Untrusted Data) vulnerabilities

CVE-2026-41104 — Critical (CVSS 10.0): Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose…
CVE-2026-43633 — Critical (CVSS 10.0): HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a…
CVE-2026-33819 — Critical (CVSS 10.0): Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network.
CVE-2026-20131 — Critical (CVSS 10.0): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could…
CVE-2026-25632 — Critical (CVSS 10.0): EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water…
CVE-2025-14931 — Critical (CVSS 10.0): Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability.…

Browse all CWE-502 (Deserialization of Untrusted Data) vulnerabilities →