Read the docs
TI-2025-11887 Aliases CVE-2025-12977GHSA-v498-rhc6-28g9

Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize…

Priority MEDIUM 47CWE-1287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the ability to write records into Splunk or Elasticsearch can supply tag_key values containing special characters such as newlines or ../ that are treated as valid tags. Because tags influence routing and some outputs derive filenames or contents from tags, this can allow newline injection, path traversal, forged record injection, or log misrouting, impacting data integrity and log routing.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00756 55th percentileScored 2026-11-07
Fix Fixed Fluent Bit (FluentBit): 4.0.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FluentBitFluent Bitbefore 4.0.124.0.12Patch availableCNA
  • Fluent Bit VendorFluentBit Affected before 4.0.12 Fixed in 4.0.12 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:treasuredata:fluent_bit:4.1.0:*:*:*:*:*:*:*4.1.0VulnerableFluentBit
  • cpe:2.3:a:treasuredata:fluent_bit:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·FluentBit

Remediation

  • Fix · CNA Fluent Bit (FluentBit) Fixed in 4.0.12

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    FluentBit Fluent Bit 4.0.12

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2025-11880 Buffer overflow in FluentBit Fluent BitPriority MEDIUM 42
    • TI-2025-11882 Path traversal in FluentBit Fluent BitPriority LOW 32
    • TI-2025-11888 Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the…Priority LOW 25
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-12977
  2. 2026-10-03 Alias added: GHSA-v498-rhc6-28g9

References

Other 2

  • TI-2024-17419 fluent-bit 2.2.2 contains a Use-After-Free vulnerability in /fluent-bit/plugins/custom_calyptia/calyptia.c. CVSS 3.1HIGH 7.5
  • TI-2024-15728 In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an… CVSS 3.1HIGH 7.5
  • TI-2024-04026 Fluent Bit Memory Corruption Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2021-21547 An issue was discovered in Treasure Data Fluent Bit 1.7.1, a wrong variable is used to… CVSS 3.1HIGH 7.8
  • TI-2021-21546 An issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in… CVSS 3.1HIGH 7.8
  • TI-2025-21098 An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via… CVSS 3.1MEDIUM 5.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences