fluent-bit vulnerabilities

2 known vulnerabilities in fluent-bit from Fluent. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.2 Critical severity

  fluent-bit: Stack-based Buffer Overflow

  CVE-2026-61674Sep 21, 2026Fluent

  Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Linux, BSD, macOS, and Windows. From 0.11.0 until 5.0.8, plugins/out_forward/forward.c secure_forward_pong copies the server-controlled PONG[2] reason into the 32-byte stack buffer ms

• 7.5 High severity

  fluent_bit: NULL Pointer Dereference

  CVE-2024-23722Mar 26, 2024Fluent

  In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It crashes and does not restart. This could result in logs not being delivered properly.