FB
Product
Fluent Bit
18
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 10Medium 5Low 0
Watch
Add Fluent Bit to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-4323 | 9.8 | May 20 | Fluent Bit Memory Corruption Vulnerability Affected: 2.0.7 before 2.2.3; 3.0.0 before 3.0.4 |
| CVE-2021-36088 | 9.8 | Jul 1 | Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb_free (called from flb_parser_json_do and flb_parser_do) Affected: 1.7.0 through 1.7.4 |
| CVE-2025-12977 | 9.1 | Nov 24 | No description published yet Affected: 4.1.0 |
| CVE-2025-12970 | 8.8 | Nov 24 | No description published yet Affected: 4.1.0 |
| CVE-2021-46878 | 7.8 | Apr 11 | An issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in flb_pack_msgpack_to_json_format leads to type confusion bug that interprets whatever is on the… Affected: 1.7.1 |
| CVE-2021-46879 | 7.8 | Apr 11 | An issue was discovered in Treasure Data Fluent Bit 1.7.1, a wrong variable is used to get the msgpack data resulting in a heap overflow in flb_msgpack_gelf_value_ext Affected: 1.7.1 |
| CVE-2020-35963 | 7.8 | Jan 3 | flb_gzip_compress in flb_gzip.c in Fluent Bit before 1.6.4 has an out-of-bounds write because it does not use the correct calculation of the maximum gzip data-size expansion Affected: before 1.6.4 |
| CVE-2024-50608 | 7.5 | Feb 18 | An issue was discovered in Fluent Bit 3.1.9 Affected: 3.1.9 |
| CVE-2024-50609 | 7.5 | Feb 18 | An issue was discovered in Fluent Bit 3.1.9 Affected: 3.1.9 |
| CVE-2024-23722 | 7.5 | Mar 26 | In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded Affected: 2.1.8 before 2.2.2 |
| CVE-2024-26455 | 7.5 | Feb 26 | fluent-bit 2.2.2 contains a Use-After-Free vulnerability in /fluent-bit/plugins/custom_calyptia/calyptia.c Affected: 2.2.2 |
| CVE-2021-27186 | 7.5 | Feb 10 | Fluent Bit 1.6.10 has a NULL pointer dereference when an flb_malloc return value is not validated by flb_avro.c or http_server/api/v1/metrics.c Affected: 1.6.10 |
| CVE-2019-9749 | 7.5 | Mar 13 | An issue was discovered in the MQTT input plugin in Fluent Bit through 1.0.4 Affected: through 1.0.4 |
| CVE-2025-12969 | 6.5 | Nov 24 | No description published yet Affected: 4.1.0 |
| CVE-2025-29478 | 5.5 | Apr 7 | An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the cfl_list_size in cfl_list.h:165 Affected: All versions, or not specified |
| CVE-2025-29477 | 5.5 | Apr 4 | An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event Affected: All versions, or not specified |
| CVE-2025-12978 | 5.4 | Nov 24 | No description published yet Affected: 4.1.0 |
| CVE-2025-12972 | 5.3 | Nov 24 | No description published yet Affected: 4.1.0 |
Showing 18