Read the docs
TI-2026-44158 Aliases CVE-2026-61674

Fluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handler

Priority HIGH 75CWE-121Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Linux, BSD, macOS, and Windows. From 0.11.0 until 5.0.8, plugins/out_forward/forward.c secure_forward_pong copies the server-controlled PONG[2] reason into the 32-byte stack buffer msg with memcpy without checking its MessagePack type or length. An attacker who controls or can impersonate an out_forward Secure Forward destination configured with Shared_Key or Empty_Shared_Key can send an oversized reason during the first handshake and overwrite stack control data. Protected builds reliably terminate, while builds without a stack canary or with a disclosure can allow remote code execution as the Fluent Bit process user. When the opt-in --supervisor mode is used, fork-only respawns preserve the canary and address layout, allowing repeated crash-or-survive probes to support code execution on a hardened build; ordinary exec-based or service-manager restarts do not preserve that state. This issue is fixed in version 5.0.8.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0072 54th percentileScored 2026-11-07
Fix Fixed fluent-bit (fluent): 5.0.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fluentfluent-bit0.11.0 to before 5.0.85.0.8Patch availableCNA
  • fluent-bit Vendorfluent Affected 0.11.0 to before 5.0.8 Fixed in 5.0.8 Patch available CNA

Remediation

  • Fix · CNA fluent-bit (fluent) Fixed in 5.0.8

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61674
  2. 2026-10-07 Affected versions changed · Red Hat
  3. 2026-10-07 CVSS score added · Red Hat

References

Other 4

  • TI-2022-18753 Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration) CVSS 3.1CRITICAL 9.8
  • TI-2026-32064 Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder CVSS 3.1CRITICAL 9.8
  • TI-2017-07995 Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may… CVSS 3.0CRITICAL 9.8
  • TI-2020-14076 An issue was discovered in Fluent-ui v.1.2.2 allows attackers to gain escalated… CVSS 3.1HIGH 8.8
  • TI-2026-32142 Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward` CVSS 3.1HIGH 7.5
  • TI-2026-32065 Fluentd: Exposure of Sensitive Information via Monitor Agent API CVSS 3.1HIGH 7.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences