Fluentbit - vulnerabilities (CVEs)

5 CVEs in 1 products, 0 in the last 30 days, newest from 2025-11-24.

Products

CVE-2025-12972 - CVSS 5.3 (medium), 2025-11-24: Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted…
CVE-2025-12970 - CVSS 8.8 (high), 2025-11-24: The extract_name function in Fluent Bit in_docker input plugin copies container names into a fixed size stack buffer without validating length. An attacker…
CVE-2025-12978 - CVSS 5.4 (medium), 2025-11-24: Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length…
CVE-2025-12969 - CVSS 6.5 (medium), 2025-11-24: Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditions. This allows…
CVE-2025-12977 - CVSS 9.1 (critical), 2025-11-24: Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the ability to write…