CVE-2022-39379: Fedoraproject Fedora

Critical severity, CVSS 9.8. EPSS: 45% chance of exploitation in the next 30 days.

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a workaround do not use `FLUENT_OJ_OPTION_MODE=object`.

Affected products

• Fedoraproject Fedora: version 37 only
• Fluentd Fluentd: from 1.13.2, before 1.15.3 (fixed in 1.15.3)

Published 2022-11-02. Last modified 2026-06-17.