Fluent vulnerabilities
We track 7 vulnerabilities in Fluent products across 2 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on September 21, 2026.
Latest Fluent vulnerabilities
- 9.2 Critical severity
fluent-bit: Stack-based Buffer Overflow
Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Linux, BSD, macOS, and Windows. From 0.11.0 until 5.0.8, plugins/out_forward/forward.c secure_forward_pong copies the server-controlled PONG[2] reason into the 32-byte stack buffer ms
- 7.2 High severity
fluentd: Server-Side Request Forgery
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag} in the endpoint configuration parameter, and if a pla
- 7.5 High severity
fluentd: Improper Handling of Highly Compressed Data (Data Amplification)
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's in_http and in_forward plugins support gzip-compressed data but enforce limits only on compressed payloads throug
- 7.5 High severity
fluentd: Missing Authentication for Critical Functionality
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's Monitor Agent plugin in_monitor_agent exposes internal metrics and plugin information via a REST API, and respons
- 9.8 Critical severity
fluentd: Improper Limitation of a Pathname to a Restricted Directory
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamically constructing file paths using the ${tag} placeholder, and insufficient validation of ${tag} in f
- 7.5 High severity
fluent_bit: NULL Pointer Dereference
In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It crashes and does not restart. This could result in logs not being delivered properly.
- 9.8 Critical severity
fluentd: Deserialization of Untrusted Data
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary c