Read the docs
TI-2025-11888 Aliases CVE-2025-12978GHSA-7qw4-6c7x-f3pj

Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the…

Priority LOW 25Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote attacker with authenticated or exposed access to these input endpoints can exploit this behavior to manipulate tags and redirect records to unintended destinations. This compromises the authenticity of ingested logs and can allow injection of forged data, alert flooding and routing manipulation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00408 35th percentileScored 2026-11-07
Fix Fixed Fluent Bit (FluentBit): 4.0.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FluentBitFluent Bitbefore 4.0.124.0.12Patch availableCNA
  • Fluent Bit VendorFluentBit Affected before 4.0.12 Fixed in 4.0.12 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:treasuredata:fluent_bit:4.1.0:*:*:*:*:*:*:*4.1.0VulnerableFluentBit
  • cpe:2.3:a:treasuredata:fluent_bit:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·FluentBit

Remediation

  • Fix · CNA Fluent Bit (FluentBit) Fixed in 4.0.12

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    FluentBit Fluent Bit 4.0.12

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2025-11887 Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize…Priority MEDIUM 47
    • TI-2025-11880 Buffer overflow in FluentBit Fluent BitPriority MEDIUM 42
    • TI-2025-11882 Path traversal in FluentBit Fluent BitPriority LOW 32
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-12978
  2. 2026-10-03 Alias added: GHSA-7qw4-6c7x-f3pj

References

Other 1

  • TI-2024-17419 fluent-bit 2.2.2 contains a Use-After-Free vulnerability in /fluent-bit/plugins/custom_calyptia/calyptia.c. CVSS 3.1HIGH 7.5
  • TI-2024-15728 In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an… CVSS 3.1HIGH 7.5
  • TI-2024-04026 Fluent Bit Memory Corruption Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2021-21547 An issue was discovered in Treasure Data Fluent Bit 1.7.1, a wrong variable is used to… CVSS 3.1HIGH 7.8
  • TI-2021-21546 An issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in… CVSS 3.1HIGH 7.8
  • TI-2025-21098 An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via… CVSS 3.1MEDIUM 5.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences