CVE-2026-61674: Fluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handler
Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Linux, BSD, macOS, and Windows. From 0.11.0 until 5.0.8, plugins/outforward/forward.c secureforwardpong copies the server-controlled PONG[2] reason into the 32-byte stack buffer msg with memcpy without checking its MessagePack type or length. An attacker who controls or can impersonate an outforward Secure Forward destination configured with SharedKey or EmptySharedKey can send an oversized reason during the first handshake and overwrite stack control data. Protected builds reliably terminate, while builds without a stack canary or with a disclosure can allow remote code execution as the Fluent Bit process user. When the opt-in --supervisor mode is used, fork-only respawns preserve the canary and address layout, allowing repeated crash-or-survive probes to support code execution on a hardened build; ordinary exec-based or service-manager restarts do not preserve that state. This issue is fixed in version 5.0.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fluent Bit (plugins/out_forward/forward.c secure_forward_pong)to a version that resolves this vulnerability.Fixed in 5.0.8
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Fluent Bit versions from 0.11.0 through versions before 5.0.8 are affected when the out_forward plugin uses a Secure Forward destination configured with Shared_Key or Empty_Shared_Key. The attacker must control or be able to impersonate that destination.
When can an attacker trigger the overflow?
The overflow can be triggered during the first Secure Forward handshake by sending an oversized PONG[2] reason field. The vulnerable handler copies that server-controlled value into a 32-byte stack buffer without validating its MessagePack type or length.
What is the likely impact on protected versus unprotected builds?
Builds with stack protection reliably terminate on exploitation attempts. Builds without a stack canary, or where a disclosure is available, may allow remote code execution as the Fluent Bit process user.
Does supervisor mode change the exploitation risk?
Yes. The opt-in --supervisor mode uses fork-only respawns that preserve the stack canary and address layout, enabling repeated crash-or-survive probing that can support code execution even on a hardened build. Ordinary exec-based or service-manager restarts do not preserve that state.
What version fixes the vulnerability?
The issue is fixed in Fluent Bit version 5.0.8.