THREATIST.IORead the docs No FluentBit vulnerabilities are listed in CISA KEV.
18 records in Fluent Bit · all components
fluent-bit 2.2.2 contains a Use-After-Free vulnerability in /fluent-bit/plugins/custom_calyptia/calyptia.c.
In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded.
A memory corruption vulnerability in Fluent Bit versions 2.0.7 thru 3.0.3.
An issue was discovered in Treasure Data Fluent Bit 1.7.1, a wrong variable is used to get the msgpack data resulting in a heap overflow in flb_msgpack_gelf_value_ext.
An issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in flb_pack_msgpack_to_json_format leads to type confusion bug that interprets whatever is on the stack as msgpack maps and arrays, leading to…
An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the cfl_list_size in cfl_list.h:165.
An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event.
Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb_free (called from flb_parser_json_do and flb_parser_do).
Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs.
The extract_name function in Fluent Bit in_docker input plugin copies container names into a fixed size stack buffer without validating length.
An issue was discovered in Fluent Bit 3.1.9.
An issue was discovered in Fluent Bit 3.1.9.
Fluent Bit 1.6.10 has a NULL pointer dereference when an flb_malloc return value is not validated by flb_avro.c or http_server/api/v1/metrics.c.
flb_gzip_compress in flb_gzip.c in Fluent Bit before 1.6.4 has an out-of-bounds write because it does not use the correct calculation of the maximum gzip data-size expansion.
Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditions.
An issue was discovered in the MQTT input plugin in Fluent Bit through 1.0.4.
Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names.
Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matching.