CVE-2025-12978

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12978", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2025-11-10T18:57:32.141Z", "datePublished": "2025-11-24T14:42:06.305Z", "dateUpdated": "2026-01-07T15:36:44.975Z"}, "containers": {"cna": {"title": "CVE-2025-12978", "descriptions": [{"lang": "en", "value": "Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote attacker with authenticated or exposed access to these input endpoints can exploit this behavior to manipulate tags and redirect records to unintended destinations. This compromises the authenticity of ingested logs and can allow injection of forged data, alert flooding and routing manipulation."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "FluentBit", "product": "Fluent Bit", "versions": [{"status": "affected", "version": "0", "lessThan": "4.0.12", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-187: Partial String Comparison"}]}], "references": [{"url": "https://fluentbit.io/announcements/v4.1.0/"}], "x_generator": {"engine": "VINCE 3.0.31", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2025-12978"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-01-07T15:36:44.975Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-11-24T15:29:03.000953Z", "id": "CVE-2025-12978", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-24T15:29:06.000Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-12978", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-24T15:29:03.000953Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-24T15:10:53.870Z"}}], "cna": {"title": "CVE-2025-12978", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "FluentBit", "product": "Fluent Bit", "versions": [{"status": "affected", "version": "0", "lessThan": "4.0.12", "versionType": "custom"}]}], "references": [{"url": "https://fluentbit.io/announcements/v4.1.0/"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.31", "origin": "https://cveawg.mitre.org/api/cve/CVE-2025-12978"}, "descriptions": [{"lang": "en", "value": "Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote attacker with authenticated or exposed access to these input endpoints can exploit this behavior to manipulate tags and redirect records to unintended destinations. This compromises the authenticity of ingested logs and can allow injection of forged data, alert flooding and routing manipulation."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-187: Partial String Comparison"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-01-07T15:36:44.975Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12978", "state": "PUBLISHED", "dateUpdated": "2026-01-07T15:36:44.975Z", "dateReserved": "2025-11-10T18:57:32.141Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2025-11-24T14:42:06.305Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Fluent Bit", "vendor": "FluentBit", "versions": [{"lessThan": "4.0.12", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cret@cert.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:treasuredata:fluent_bit:4.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "4D0EA105-B741-4E44-828A-9300B09A7A79", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote attacker with authenticated or exposed access to these input endpoints can exploit this behavior to manipulate tags and redirect records to unintended destinations. This compromises the authenticity of ingested logs and can allow injection of forged data, alert flooding and routing manipulation."}, {"lang": "es", "value": "Los plugins de entrada in_http, in_splunk e in_elasticsearch de Fluent Bit contienen una falla en la l\u00f3gica de validaci\u00f3n de tag_key que no logra aplicar la coincidencia exacta de la longitud de la clave. Esto permite entradas manipuladas donde un prefijo de etiqueta se trata incorrectamente como una coincidencia completa. Un atacante remoto con acceso autenticado o expuesto a estos puntos finales de entrada puede explotar este comportamiento para manipular etiquetas y redirigir registros a destinos no deseados. Esto compromete la autenticidad de los registros ingeridos y puede permitir la inyecci\u00f3n de datos falsificados, la inundaci\u00f3n de alertas y la manipulaci\u00f3n del enrutamiento."}], "id": "CVE-2025-12978", "lastModified": "2026-10-08T10:10:00.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12978", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-24T15:29:03.000953Z", "version": "2.0.3"}}]}, "published": "2025-11-24T15:15:46.873", "references": [{"source": "cret@cert.org", "tags": ["Release Notes"], "url": "https://fluentbit.io/announcements/v4.1.0/"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"created": "2025-11-26T11:10:41.881920+00:00", "updated": "2025-11-26T11:10:41.881945+00:00", "vendors": ["fluentbit", "fluentbit$PRODUCT$fluent_bit"]}