Treasuredata maintains a focused but widely integrated portfolio centered on data collection and workflow orchestration tools, particularly Fluent Bit and Digdag, which sit upstream in log-aggregation and data-pipeline architectures across many deployments. Vulnerabilities affecting the vendor skew toward serious outcomes, with a meaningful share reaching critical severity, and recur through memory-safety and access-control weaknesses including NULL-pointer dereferences, out-of-bounds writes, path-traversal issues, and resource-exhaustion flaws that are characteristic of systems handling untrusted input at scale. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Treasuredata over time
Signals from CVEs in this vendor scope (19 CVEs).
19 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-4323CRITICAL A memory corruption vulnerability in Fluent Bit versions 2.0.7 thru 3.0.3. This issue lies in the embedded http server’s parsing of trace requests and may result in denial of servi | May 20, 2024 | 9.8 | 48 | NO | NO |
CVE-2025-12970HIGH The extract_name function in Fluent Bit in_docker input plugin copies container names into a fixed size stack buffer without validating length. An attacker who can create container | Nov 24, 2025 | 8.8 | 31 | NO | NO |
CVE-2025-12977CRITICAL Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the ability to write records into Splunk or El | Nov 24, 2025 | 9.1 | 30 | NO | NO |
CVE-2024-25125MEDIUM Digdag is an open source tool that to build, run, schedule, and monitor complex pipelines of tasks across various platforms. Treasure Data's digdag workload automation system is su | Feb 14, 2024 | 5.3 | 29 | NO | NO |
CVE-2021-36088CRITICAL Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb_free (called from flb_parser_json_do and flb_parser_do). | Jul 1, 2021 | 9.8 | 29 | NO | NO |
CVE-2021-46879HIGH An issue was discovered in Treasure Data Fluent Bit 1.7.1, a wrong variable is used to get the msgpack data resulting in a heap overflow in flb_msgpack_gelf_value_ext. An attacker | Apr 11, 2023 | 7.8 | 25 | NO | NO |
CVE-2025-12969MEDIUM Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditions. This allows remote attackers with n | Nov 24, 2025 | 6.5 | 24 | NO | NO |
CVE-2024-50609HIGH An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 an | Feb 18, 2025 | 7.5 | 24 | NO | NO |
CVE-2024-50608HIGH An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet with Content-Le | Feb 18, 2025 | 7.5 | 24 | NO | NO |
CVE-2020-35963HIGH flb_gzip_compress in flb_gzip.c in Fluent Bit before 1.6.4 has an out-of-bounds write because it does not use the correct calculation of the maximum gzip data-size expansion. | Jan 3, 2021 | 7.8 | 24 | NO | NO |
Signals from CVEs in this vendor scope (19 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Treasuredata.
Media articles that mention a CVE ID that affects a product developed by Treasuredata — matched by CVE ID, not by vendor name.