[Q&A] CVE-2026-13221 (perl v5.40.1) in fluentd:v1.19.3-debian-1.0

[anton-vahcic]

What is a problem?

https://hub.docker.com/layers/library/fluentd/v1.19.3-debian-1.0/images/sha256-b27ef1d471f55dbf2d05db7cdf954e9e2ec64d51755d38f20e74c56828f5ebd0

contains the CVE ID. But not the CVE-2026-13221 is not on the list. It seems it was, but then removed. Any idea?

Secondly, going into the image itself, running perl -v, i get

$ perl -v

This is perl 5, version 40, subversion 1 (v5.40.1) built for x86_64-linux-gnu-thread-multi
(with 48 registered patches, see perl -V for more detail)

Considering that https://nvd.nist.gov/vuln/detail/cve-2026-13221 any perl up to (including) 5.43.9 is affected, I would expect cve-2026-13221 being part of the list.

Describe the configuration of Fluentd

download into docker images, run it, and attach to process.

Describe the logs of Fluentd

No response

Environment

- Fluentd version: 
$ fluentd --version
fluentd 1.19.3

- TD Agent version:

- Fluent Package version:

- Docker image (tag): fluentd:v1.19.3-debian-1.0

- Operating system: 
PRETTY_NAME="Debian GNU/Linux 13 (trixie)"
NAME="Debian GNU/Linux"
VERSION_ID="13"
VERSION="13 (trixie)"
VERSION_CODENAME=trixie
DEBIAN_VERSION_FULL=13.6
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

- Kernel version:

[kenhys]

You mention about https://hub.docker.com/_/fluentd/, not https://hub.docker.com/r/fluent/fluentd.
(Thus it's out of scope from fluentd maintainer side)

That image was derived from https://github.com/docker-library/official-images.
I don't know how they are built nor scanned vulnerability. so it might be better to ask there.

FYI: CVE-2026-13321 will be fixed in next Debian 13.7 point release (around Sep 12?), so we will update https://hub.docker.com/r/fluent/fluentd images later.

trixie-pu: package perl/5.40.1-6+deb13u1
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146369