Priority LOW 25
Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matching.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00408 · Published 2025-11-24 · Fixed in 4.0.12
Priority LOW 36
Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditions.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00631 · Published 2025-11-24 · Fixed in 4.0.13 CWE-306
Priority LOW 32
Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00931 · Published 2025-11-24 · Fixed in 4.0.12 CWE-22
Priority MEDIUM 47
Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00756 · Published 2025-11-24 · Fixed in 4.0.12 CWE-1287
Priority MEDIUM 42
The extract_name function in Fluent Bit in_docker input plugin copies container names into a fixed size stack buffer without validating length.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01074 · Published 2025-11-24 · Fixed in 4.0.12 CWE-120
Priority MEDIUM 58
An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the cfl_list_size in cfl_list.h:165.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00207 · Published 2025-04-07 · No fix listed CWE-400
Priority MEDIUM 58
An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · User interaction · EPSS 0.00185 · Published 2025-04-04 · No fix listed CWE-400
Priority MEDIUM 41
An issue was discovered in Fluent Bit 3.1.9.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01114 · Published 2025-02-18 · No fix listed CWE-476
Priority MEDIUM 41
An issue was discovered in Fluent Bit 3.1.9.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01114 · Published 2025-02-18 · No fix listed CWE-476
Priority HIGH 71
A memory corruption vulnerability in Fluent Bit versions 2.0.7 thru 3.0.3.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.27043 · Published 2024-05-20 · No fix listed CWE-122
Priority HIGH 72
In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00952 · Published 2024-03-26 · No fix listed CWE-476
Priority HIGH 72
fluent-bit 2.2.2 contains a Use-After-Free vulnerability in /fluent-bit/plugins/custom_calyptia/calyptia.c.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00707 · Published 2024-02-26 · No fix listed CWE-416
Priority HIGH 69
An issue was discovered in Treasure Data Fluent Bit 1.7.1, a wrong variable is used to get the msgpack data resulting in a heap overflow in flb_msgpack_gelf_value_ext.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.0038 · Published 2023-04-11 · No fix listed CWE-787
Priority HIGH 69
An issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in flb_pack_msgpack_to_json_format leads to type confusion bug that interprets whatever is on the stack as msgpack maps and arrays, leading to…
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.0035 · Published 2023-04-11 · No fix listed CWE-843
Priority MEDIUM 53
Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb_free (called from flb_parser_json_do and flb_parser_do).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02384 · Published 2021-07-01 · No fix listed CWE-415
Priority LOW 37
Fluent Bit 1.6.10 has a NULL pointer dereference when an flb_malloc return value is not validated by flb_avro.c or http_server/api/v1/metrics.c.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02011 · Published 2021-02-10 · No fix listed CWE-476
Priority LOW 37
flb_gzip_compress in flb_gzip.c in Fluent Bit before 1.6.4 has an out-of-bounds write because it does not use the correct calculation of the maximum gzip data-size expansion.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.01326 · Published 2021-01-03 · No fix listed CWE-787
Priority LOW 36
An issue was discovered in the MQTT input plugin in Fluent Bit through 1.0.4.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01657 · Published 2019-03-13 · No fix listed CWE-681
THREATIST.IORead the docs