Fluent Bit
Approved changes feed: RSS · Atom
cpe:2.3:a:treasuredata:fluent_bit:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Treasuredata (a2f7f978-9f56-53bc-bab6-aabf49d45231) |
|---|---|
| Product | Fluent Bit (362de095-bd91-5cec-be90-8c97573460c9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/fluent/fluent-bit |
purl2cpe | 2026-06-01 10:12:13.592970 |
pkg:rpm/fedora/fluent-bit |
purl2cpe | 2026-06-01 10:12:13.592973 |
pkg:rpm/opensuse/fluent-bit |
purl2cpe | 2026-06-01 10:12:13.592976 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-4323 |
vulnerable | 2026-06-08 06:50:17.510687 |
Fluent Bit Memory Corruption Vulnerability
CRITICAL (9.8)
A memory corruption vulnerability in Fluent Bit versions 2.0.7 thru 3.0.3. This issue lies in the embedded http server’s parsing of trace requests and may result in denial of service conditions, information disclosure, or remote code execution.
Published: 2024-05-20T12:06:21.696Z
Updated: 2024-08-19T07:47:45.924Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-23722 |
vulnerable | 2026-06-08 06:29:40.310058 |
Details available
In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It crashes and does not restart. This could result in logs not being delivered properly.
Published: 2024-03-26T00:00:00.000Z
Updated: 2024-08-06T13:47:16.123Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-36088 |
vulnerable | 2026-06-08 05:32:49.708580 |
Details available
Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb_free (called from flb_parser_json_do and flb_parser_do).
Published: 2021-07-01T02:50:19.000Z
Updated: 2024-08-04T00:47:43.818Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-35963 |
vulnerable | 2026-06-08 05:25:02.382619 |
Details available
flb_gzip_compress in flb_gzip.c in Fluent Bit before 1.6.4 has an out-of-bounds write because it does not use the correct calculation of the maximum gzip data-size expansion.
Published: 2021-01-03T18:15:48.000Z
Updated: 2024-08-04T17:16:13.850Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-9749 |
vulnerable | 2026-06-08 05:14:26.190659 |
Details available
An issue was discovered in the MQTT input plugin in Fluent Bit through 1.0.4. When this plugin acts as an MQTT broker (server), it mishandles incoming network messages. After processing a crafted packet, the plugin's mqtt_packet_drop function (in /plugins/in_mqtt/mqtt_prot.c) executes the memmove() function with a negative size parameter. That leads to a crash of the whole Fluent Bit server via a SIGSEGV signal.
Published: 2019-03-13T19:00:00.000Z
Updated: 2024-09-16T22:29:41.796Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.