Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2025-12978

CVE-2025-12978

Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote attacker with authenticated or exposed access to these input endpoints can exploit this behavior to manipulate tags and redirect records to unintended destinations. This compromises the authenticity of ingested logs and can allow injection of forged data, alert flooding and routing manipulation.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fluentbit Treasuredata
Products
Fluent Bit Fluent Bit
CVE-2025-12970

CVE-2025-12970

The extract_name function in Fluent Bit in_docker input plugin copies container names into a fixed size stack buffer without validating length. An attacker who can create containers or control container names, can supply a long name that overflows the buffer, leading to process crash or arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed
Vendors
Fluentbit Treasuredata
Products
Fluent Bit Fluent Bit
CVE-2025-12972

CVE-2025-12972

Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause Fluent Bit to write files outside the intended output directory.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Fluentbit Treasuredata
Products
Fluent Bit Fluent Bit
CVE-2025-12977

CVE-2025-12977

Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the ability to write records into Splunk or Elasticsearch can supply tag_key values containing special characters such as newlines or ../ that are treated as valid tags. Because tags influence routing and some outputs derive filenames or contents from tags, this can allow newline injection, path traversal, forged record injection, or log misrouting, impacting data integrity and log routing.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Fluentbit Treasuredata
Products
Fluent Bit Fluent Bit