https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-12978.htmlhttps://patchthecve.com/cve/CVE-2025-12978.htmlThu, 08 Oct 2026 10:10:00 +0000MEDIUM 5.4: Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote attacker with authenticated or exposed accehttps://patchthecve.com/cve/CVE-2025-12977.htmlhttps://patchthecve.com/cve/CVE-2025-12977.htmlSun, 18 Oct 2026 20:10:00 +0000CRITICAL 9.1: Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the ability to write records into Splunk or Elasticsearch can supply tag_key values containing special characters such as newlines or ../ that are treated as valid tahttps://patchthecve.com/cve/CVE-2025-12972.htmlhttps://patchthecve.com/cve/CVE-2025-12972.htmlThu, 08 Oct 2026 10:10:00 +0000MEDIUM 5.3: Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause Fluenhttps://patchthecve.com/cve/CVE-2025-12970.htmlhttps://patchthecve.com/cve/CVE-2025-12970.htmlSun, 18 Oct 2026 20:10:00 +0000HIGH 8.8: The extract_name function in Fluent Bit in_docker input plugin copies container names into a fixed size stack buffer without validating length. An attacker who can create containers or control container names, can supply a long name that overflows the buffer, leading to process crash or arbitrary cohttps://patchthecve.com/cve/CVE-2025-12969.htmlhttps://patchthecve.com/cve/CVE-2025-12969.htmlThu, 08 Oct 2026 10:10:00 +0000MEDIUM 6.5: Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditions. This allows remote attackers with network access to the Fluent Bit instance exposing the forward input to send unauthenticated data. By bypassing authentichttps://patchthecve.com/cve/CVE-2025-29478.htmlhttps://patchthecve.com/cve/CVE-2025-29478.htmlWed, 17 Jun 2026 09:05:25 +0000MEDIUM 5.5: An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the cfl_list_size in cfl_list.h:165.https://patchthecve.com/cve/CVE-2025-29477.htmlhttps://patchthecve.com/cve/CVE-2025-29477.htmlWed, 17 Jun 2026 09:05:25 +0000MEDIUM 5.5: An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event.https://patchthecve.com/cve/CVE-2024-50609.htmlhttps://patchthecve.com/cve/CVE-2024-50609.htmlWed, 17 Jun 2026 08:04:47 +0000HIGH 7.5: An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoihttps://patchthecve.com/cve/CVE-2024-50608.htmlhttps://patchthecve.com/cve/CVE-2024-50608.htmlWed, 17 Jun 2026 08:04:47 +0000HIGH 7.5: An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to https://patchthecve.com/cve/CVE-2024-4323.htmlhttps://patchthecve.com/cve/CVE-2024-4323.htmlWed, 17 Jun 2026 08:01:40 +0000CRITICAL 9.8: A memory corruption vulnerability in Fluent Bit versions 2.0.7 thru 3.0.3. This issue lies in the embedded http server’s parsing of trace requests and may result in denial of service conditions, information disclosure, or remote code execution.https://patchthecve.com/cve/CVE-2024-23722.htmlhttps://patchthecve.com/cve/CVE-2024-23722.htmlWed, 17 Jun 2026 07:13:27 +0000HIGH 7.5: In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It crashes and does not restart. This could result in logs not being delivered properly.