Hi users!
We have released v1.19.4 on 2026-09-29. ChangeLog is here.
This release is a maintenance release of v1.19 series.
This release will be bundled for fluent-package LTS version v6.0.5!
Many vulnerabilities were fixed in this release.
.. Tag in Output Plugins
${tag} placeholder in the path parameter of output plugins. Filter incoming untrusted tags.in_http ndjson parsing
in_http, allow connection within a closed, trusted network. Implement reverse proxy limits with forcing strict rate limiting and request size limits at the proxy layer to drop anomalous requests before they reach the Fluentd worker.in_syslog
in_syslog, allow connection within a closed, trusted network. Switch to UDP Transport for a while. Implement reverse proxy limits with strict client connection timeout and buffer size limits to terminate anomalous, non-delimited streams before they overwhelm Fluentd.disable_chunk_backup true. Restrict incoming data only within a closed, trusted network.In most cases, there is no problem using deployed Fluentd within a closed, trusted network. If you could not update Fluentd immediately, consider to take advised mitigation in above advisories.
Many bugs were also fixed in this release.
output: fix JSON::GeneratorError as unrecoverable error. (#5423)
allow_duplicate_key parameter for JSON.parse. It accept duplicate keys silently
(last value wins) on every path. It keeps compatibility with older versions even though
newer json gem is used. (#5430)allow_comments parameter for JSON.parse. It accepts JSON with comments.
It keeps compatibility with older versions even though newer json gem is used. (#5432)parser_syslog: Optimize RFC5424 structured data parsing (#5444)
out_forward: drop keepalive sockets with failed or mismatched acks (#5445)
buffer: fix stage_byte_size leak when a staged chunk is unstaged (#5456)
BufferOverflowError.
It affects plugins which implementing #format.plugin base: bound the number of worker lock files by hashing the path into a fixed set of buckets. (#5471)supervisor: reduce memory usage of cleanup_lock_dir with huge number of lock files (#5472)config: accept empty lines in quoted strings (#5478)chunk: ensure to close the Tempfile for decompressed data (#5486)buffer: fix spurious BufferOverflowError caused by queue_size leaking when a chunk purge fails (#5487)buffer: clamp exported buffer size metrics to non-negative values (#5488)parser_syslog: fix NameError when RFC3164 timestamp has repeated spaces (#5497)parser_syslog: fix NameError when RFC5424 timestamp has repeated spaces (#5500)In the previous versions, a single scalar value for an array option is rejected in YAML config syntax.
Since v1.19.4, it accepts the following example.
config:
- match:
$tag: "**"
$type: http
retryable_response_codes: 503
When workers > 1, out_file (with append) and
out_secondary_file take an inter-worker lock per output path, and
get_lock_path derives one lock file per path:
/tmp/fluentd-lock-*/fluentd-<sanitized path>.lock.
In the previous versions, a lock file is never removed while fluentd
is running; the only cleanup is cleanup_lock_dir at a graceful
shutdown. So the number of lock files grows with the number of unique
output paths, and with a date or a tag placeholder in path that set
is effectively unbounded over time.
In this release, the number of lock files is now bounded by a constant instead of by the number of unique paths. The accumulation, the mass deletion at shutdown, and the dependence on an external tmp cleaner all disappear structurally rather than being mitigated.
Enjoy logging!
We have been posting information about Fluentd in Japanese on @fluentd_jp. We would appreciate it if you followed the X account.
Hi users!
We have released fluent-package v6.0.5 on 2026-09-29. Fluent Package is a stable distribution package of Fluentd. (successor of td-agent)
This is a maintenance release of v6.0.x LTS series.
Fluent Package v6.0.5 includes the following improvements:
oj, json)This article explains the changes in Fluent Package v6.0.5.
In this release, some critical vulnerabilities were fixed.
.. Tag in Output Plugins
${tag} placeholder in the path parameter of output plugins. Filter incoming untrusted tags.in_http ndjson parsing
in_http, allow connection within a closed, trusted network. Implement reverse proxy limits with forcing strict rate limiting and request size limits at the proxy layer to drop anomalous requests before they reach the Fluentd worker.in_syslog
in_syslog, allow connection within a closed, trusted network. Switch to UDP Transport for a while. Implement reverse proxy limits with strict client connection timeout and buffer size limits to terminate anomalous, non-delimited streams before they overwhelm Fluentd.disable_chunk_backup true. Restrict incoming data only within a closed, trusted network.The above vulnerabilities affects to older than v1.19.4, thus the following packages also will be affected.
We recommend upgrading fluent-package to v6.0.5.
If you can't upgrade it immediately, there is a case that mitigation method is explained in above advisory. Please check each advisory and take care of it.
Fluentd v1.19.4 also contains many bug fixes. See the release announcement of Fluentd v1.19.4 for details.
Ruby 3.4.11 is a maintenance release. Compared to Ruby 3.4.9 which was bundled in the previous version, it includes the following security fixes in bundled gems:
net-imap: CVE-2026-47240, CVE-2026-47241, CVE-2026-47242 (fixed in Ruby 3.4.10)resolv: CVE-2026-80212 and CVE-2026-80213 (fixed in Ruby 3.4.11)For details, please see the Ruby 3.4.10 and Ruby 3.4.11 release notes.
The link to the enterprise services page on the popup window of the Windows installer was broken. It has been fixed in this release. (#1079)
The packages for RHEL 9.x and 10.x were built on the latest minor version of each series.
As a result, the built binaries required newer symbols such as GLIBC_2.35 or OPENSSL_3.4.0,
and they did not work on older minor versions like RHEL 9.6 or RHEL 10.1.
To keep the ABI compatible in the whole 9.x and 10.x series, the build environment is now pinned to RHEL 9.2 and RHEL 10.0. (#1089, #1090)
This issue was fixed and shipped as 6.0.4-2 on above platforms which had been implemented in advance, has now been officially released.
RPM 4.19 (AlmaLinux 10) and dpkg-buildflags on Ubuntu export LTO (Link Time Optimization) flags
(-flto=auto -ffat-lto-objects) into the build process. These flags leaked into jemalloc, Ruby and
native gem extensions, and made the build much slower. For example, the total build time on AlmaLinux 10
grew extraordinaly.
Since the bundled Ruby uses its own optimization settings, LTO gives no measurable benefit here.
So we removed the LTO flags and the annobin plugin from the build environment.
The hardening flags such as stack protection, control flow protection and FORTIFY_SOURCE are kept as before.
This change also means that native extensions which users build with fluent-gem install no longer
inherit the LTO overhead. (#1102)
Please visit the download page.
We plan to release the next LTS version of fluent-package v6.0.6 at Dec 2026. The content of updates are still TBD.
We have been posting information about Fluentd in Japanese on @fluentd_jp. We would appreciate it if you followed the X account.
Hi users!
We had launched fluent-package v6 series last year, recently shipped v6.0.4 in LTS release channel.
In this blog article, we explain the planned next major updates - v7.0.0.
In short, we will ship fluent-package v7 in Aug, 2027.
We keep two release channels as follows:
Here is the difference of these channels.
fluent-package v8.0.0, and will be shipped in 2029 (T.B.D.).As for fluent-package v7,
Current releases and future plans:
| Release Version | Release Date | End of life |
|---|---|---|
| v6.0.x (LTS) | Aug, 2025 | Dec, 2027 |
| v7.0.0 (LTS) | Aug, 2027 | Dec, 2029 (T.B.D.) |
| v8.0.0 (LTS) | Aug, 2029 (T.B.D.) | T.B.D. |
Happy logging!
Hi users!
We have released fluent-package v6.0.4 on 2026-06-26. Fluent Package is a stable distribution package of Fluentd. (successor of td-agent)
This is a maintenance release of v6.0.x LTS series.
Fluent Package v6.0.4 includes the following improvements:
This article explains the changes in Fluent Package v6.0.4.
In this release, some critical vulnerabilities were fixed.
${tag} Placeholder
shared_key for authentication, filter incoming untrusted tags.in_monitor_agent, allow connection from only localhost.in_http and in_forward
in_forward or in_http, use shared_key for authentication which allow trusted incoming source.in_opentelemetry
in_opentelemetry, use a robust reverse proxy in front of Fluentd to mitigate GZIP decompression bomb.in_s3
in_s3 is strictly limited to trusted services and administrators.The above vulnerabilities affects to older than v1.19.3, thus the following packages also will be affected.
We recommend upgrading fluent-package to v6.0.4.
If you can't upgrade it immediately, there is a case that mitigation method is explained in above advisory. Please check each advisory and take care of it.
Please visit the download page.
We plan to release the next LTS version of fluent-package v6.0.5 at Sep 2026. The content of updates are still TBD.
We have been posting information about Fluentd in Japanese on @fluentd_jp. We would appreciate it if you followed the X account.
Hi users!
We have released v1.19.3 on 2026-06-25. ChangeLog is here.
This release is a maintenance release of v1.19 series.
This release is bundled for fluent-package LTS version v6.0.4!
Many vulnerabilities were fixed in this release.
${tag} Placeholder
shared_key for authentication, filter incoming untrusted tags.Exposure of Sensitive Information via Monitor Agent API
in_monitor_agent, allow connection from only localhost.include_config, include_retry and include_debug_info parameters.<source>
@type monitor_agent
include_config true # since v1.19.3, changed to false by default
include_retry true # since v1.19.3, newly introduced, false by default
include_debug_info true # since v1.19.3, newly introduced, false by default
...
</source>
Denial of Service (DoS) via Gzip Decompression Bomb in in_http and in_forward
in_forward or in_http, use shared_key for authentication which allow trusted incoming source.Server-Side Request Forgery (SSRF) via out_http Placeholder Expansion
Additionally, similar vulnerability was also fixed in the following fluentd plugins:
In most cases, there is no problem using deployed Fluentd within a closed, trusted network. If you could not update Fluentd immediately, consider to take advised mitigation in above advisories.
Many bugs were also fixed in this release.
in_debug_agent: accept only from local machine by defaultout_forward: avoid reusing closed keepalive sockets after remotestorage_local: fix encoding error when fix encoding error when reading non-ASCII charactersin_debug_agent: accept only from local machine by defaultHistorically, in_debug_agent accepts remote access by default.
This behavior is not problem because usually in_debug_agent must be
explicitly enabled by users who know what you do.
But, there is an security concern which accepts external access by default even though user must enable it explicitly.
To mitigate security concern, changed that behavior a bit secure by default.
If you dare to keep previous non-secure behavior, specify 0.0.0.0 explicitly.
<source>
@type monitor_agent
bind 0.0.0.0 # prior to v1.19.3 default behavior
bind 127.0.0.1 # since v1.19.3 default behavior
...
</source>
If buffer path contains [] in tag something like "path test/${tag[0]}", when
resuming buffer process can't find them without escaping bracket.
Thus buffer files remains under that directory.
In this release, that can be resumed correctly.
Note that recommended tag spec is specified in routing documentation, but
it is easily shoot your legs in practical use-case if you use [] characters.
so it is changed to take care of that case.
In the previous versions, there was a keepalive socket reuse bug.
When a cached keepalive connection has already been closed by the remote side,
out_forward could pick that socket back up and try to write to it again.
As a result, that left the flush thread spinning on a dead socket and can drive CPU usage to 100%.
storage_local: fix encoding error when fix encoding error when reading non-ASCII charactersIf data containing non-latin characters are stored onto disk using the
storage_local plugin, the file is properly written but cannot be read
again once fluentd restarts. Now that behaviour was fixed by properly
handling the file encoding.
In this release, added some warnings for problematic use-cases.
If there are any potential issues with your configuration, Fluentd detects above cases additionally.
Enjoy logging!
We have been posting information about Fluentd in Japanese on @fluentd_jp. We would appreciate it if you followed the X account.
Fluentd is an open source data collector to simplify log management.
2026-08-14: Scheduled support lifecycle announcement about Fluent Package v7
2025-12-25: Drop schedule announcement about EOL of Fluent Package (fluent-package) 5
2025-09-04: Upgrade Guide for fluent-package v6
2024-08-29: Scheduled support lifecycle announcement about Fluent Package v6
2023-08-29: Drop schedule announcement about EOL of Treasure Agent (td-agent) 4
2023-08-29: Scheduled support lifecycle announcement about Fluent Package
2023-07-31: Upgrade to fluent-package v5
2026-09-29: Fluentd v1.19.4 has been released
2026-09-29: fluent-package v6.0.5 has been released
2026-08-14: Scheduled support lifecycle announcement about Fluent Package v7
2026-06-26: fluent-package v6.0.4 has been released
2026-06-25: Fluentd v1.19.3 has been released
2026-03-27: fluent-package v6.0.3 has been released
2026-02-27: fluent-package v6.0.2 has been released
2026-02-13: Fluentd v1.19.2 has been released
2025-12-25: Drop schedule announcement about EOL of Fluent Package (fluent-package) 5
2025-12-19: fluent-package v5.0.9 has been released
Want to learn the basics of Fluentd? Check out these pages.
Couldn't find enough information? Let's ask the community!
You need commercial-grade support from Fluentd committers and experts?
©2010-2026 Fluentd Project. ALL Rights Reserved.
Fluentd is a hosted project under the Cloud Native Computing Foundation (CNCF). All components are available under the Apache 2 License.
The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our Trademark Usage page, Privacy Policy and Terms of Use.