CVE-2025-29477

Published Apr 4, 2025 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

cpe:2.3:a:treasuredata:fluent_bit:-:*:*:*:*:*:*:*

No data.

No data available yet.

No solution or workaround provided in the CVE record

Source	ID	Title
EUVD	EUVD-2025-9768	An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event.

No CVSS v4.0

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.185% probability within 30 days)

References

Link	Providers
https://github.com/lmarch2/poc/blob/main/fluent-bit/fluent-bit.md

History

Type	Values Removed	Values Added
First Time appeared		Treasuredata Treasuredata fluent Bit
CPEs	cpe:2.3:a:fluentbit:fluent_bit:3.7.2:::::::*	cpe:2.3:a:treasuredata:fluent_bit:-:::::::*
Vendors & Products	Fluentbit Fluentbit fluent Bit	Treasuredata Treasuredata fluent Bit

Type	Values Removed	Values Added
First Time appeared		Fluentbit Fluentbit fluent Bit
CPEs		cpe:2.3:a:fluentbit:fluent_bit:3.7.2:::::::*
Vendors & Products		Fluentbit Fluentbit fluent Bit

Type	Values Removed	Values Added
Weaknesses		CWE-400
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event.
References		https://github.com/lmarch2/poc/blob/main/fluent-bit/fluent-bit.md