On Di, 02 Dez 2025, Christian Fischer wrote: there seems to be indeed some confusion/inconsistencies about the possible fixes: 1. [1] lists 4.2, 4.1.1 and 4.0.14 as fixes 2. [2] lists 4.0.12, 4.1.1 and 4.2.0 as fixes 3. In this thread 4.0.13 (among 4.1.1 and 4.2.0) is now listed as a fix

But if we check [3] version 4.0.13 only contains two changelog entries shared with version 4.1.1. Furthermore 4.0.12 was released more closely to 4.1.1 then 4.0.13 so the fixed versions on [2] might be the correct ones (4.0.12, 4.1.1 and 4.2.0).

Regards,

[1] https://fluentbit.io/blog/2025/10/28/security-vulnerabilities-addressed-in-fluent-bit-v4.1-and-backported-to-v4.0/ [2] https://kb.cert.org/vuls/id/761751 [3] https://github.com/fluent/fluent-bit/releases Well, I have asked upstream https://github.com/fluent/fluent-bit/issues/11230 and they have confirmed and updated the blog post[1] to mention 4.0.13 as the proper backported fix.

I did not check or even verify the other versions.

Thanks, Christian -- evakuieren: zeigt eindeutig, daß der Menschen erstes Milchvieh "o'muh" sagte.

On Mi, 26 Nov 2025, Alan Coopersmith wrote: https://fluentbit.io/blog/2025/10/28/security-vulnerabilities-addressed-in-fluent-bit-v4.1-and-backported-to-v4.0/ provides their analysis and information about fixes in versions 4.2, 4.1.1, and 4.0.14, which are available from https://github.com/fluent/fluent-bit . That blog post would hugely benefit from the actual CVE numbers and not just CWE ids.

For the record, there is a typo in the above blog post. The backported fixed version is v4.0.13

Thanks, Christian -- Das wird sicher ein Spaß -- Star Treck, Der erste Kontakt,

https://www.oligo.security/blog/critical-vulnerabilities-in-fluent-bit-expose-cloud-environments-to-remote-takeover reports these newly disclosed vulnerabilities in Fluent Bit: CVE-2025-12972: Unsanitized tag values are used to generate output filenames, allowing attackers to inject path-traversal sequences like “../” to write or overwrite arbitrary files on disk, enabling log tampering and, in many configurations, full remote code execution.

CVE-2025-12970: A stack buffer overflow in the Docker input enables attackers to trigger crashes or execute code by creating containers with excessively long names, giving them control over the Fluent Bit agent on the host.

CVE-2025-12978: A flaw in Fluent Bit’s tag-matching logic lets attackers spoof trusted tags by guessing only the first character of a TagKey, enabling them to reroute logs, bypass filters, and inject malicious or misleading records.

CVE-2025-12977: Tags derived from user-controlled fields bypass sanitization, allowing attackers to inject newlines, traversal sequences, and control characters that corrupt downstream logs or enable broader output-based attacks.

CVE-2025-12969: Fluent Bit forwarders configured with Security.Users silently disable authentication, allowing remote attackers to send logs, inject false telemetry, or flood detection systems despite appearing secured. https://fluentbit.io/blog/2025/10/28/security-vulnerabilities-addressed-in-fluent-bit-v4.1-and-backported-to-v4.0/ provides their analysis and information about fixes in versions 4.2, 4.1.1, and 4.0.14, which are available from https://github.com/fluent/fluent-bit .

-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris

Fluent Bit inhttp, insplunk, and inelasticsearch input plugins contain a flaw in the tagkey validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote attacker with authenticated or exposed access to these input endpoints can exploit this behavior to manipulate tags and redirect records to unintended destinations. This compromises the authenticity of ingested logs and can allow injection of forged data, alert flooding and routing manipulation.

Fluent Bit outfile plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause Fluent Bit to write files outside the intended output directory.

CVE-2025-12977

CVE-2025-12970

An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the cfllistsize in cfllist.h:165.

An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consumeevent.

An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the Content-Length) is passed to the function cflsdslen, which in turn tries to cast a NULL pointer into struct cflsds. This is related to processpayloadmetricsng() at promrwprot.c.

A memory corruption vulnerability in Fluent Bit versions 2.0.7 thru 3.0.3. This issue lies in the embedded http server’s parsing of trace requests and may result in denial of service conditions, information disclosure, or remote code execution.

In Fluent Bit 2.1.8 through 2.2.1 a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It crashes and does not restart. This could result in logs not being delivered properly.

fluent-bit 2.2.2 contains a Use-After-Free vulnerability in /fluent-bit/plugins/customcalyptia/calyptia.c.