FluentBit vulnerabilities
We track 2 vulnerabilities in FluentBit products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 24, 2025.
2vulnerabilities
1critical
1high
0exploited
8.9average CVSS score
Latest FluentBit vulnerabilities
- 9.1 Critical severity
Fluent Bit: Improper Validation of Specified Type of Input
Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the ability to write records into Splunk or Elasticsearch can supply tag_key values containing special characters such as newl
- 8.8 High severity
Fluent Bit: Buffer Copy without Checking Size of Input
The extract_name function in Fluent Bit in_docker input plugin copies container names into a fixed size stack buffer without validating length. An attacker who can create containers or control container names, can supply a long name that overflows the buffer,