PatchTheCVEfluent bit vulnerabilities and fixes
Recent CVEs affecting fluent bit, with upgrade or downgrade steps. 9 tracked.
Also searched as: fluentbit.
fluent bit has 9 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 0. Most recent: 2025-11-24. Highest priority: CVE-2024-50609 (score 53/100).
- CVE-2025-12970 HIGH 8.8 DOWNGRADE The extract_name function in Fluent Bit in_docker input plugin copies container names into a fixed size stack
- CVE-2025-12977 CRITICAL 9.1 DOWNGRADE Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs
- CVE-2025-12969 MEDIUM 6.5 DOWNGRADE Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under
- CVE-2025-12972 MEDIUM 5.3 DOWNGRADE Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names
- CVE-2025-12978 MEDIUM 5.4 DOWNGRADE Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation log
- CVE-2025-29478 MEDIUM 5.5 MITIGATE An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the cfl_list_size in c
- CVE-2025-29477 MEDIUM 5.5 MITIGATE An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_e
- CVE-2024-50609 HIGH 7.5 DOWNGRADE An issue was discovered in Fluent Bit 3.1.9
- CVE-2024-50608 HIGH 7.5 DOWNGRADE An issue was discovered in Fluent Bit 3.1.9
FAQ
How do I fix fluent bit vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is fluent bit being exploited right now?
None of the tracked fluent bit CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which fluent bit CVE should I patch first?
CVE-2024-50609 currently ranks highest (53/100): An issue was discovered in Fluent Bit 3.1.9.