Fluent Bit
Vendor:
First CVE: Mar 13, 2019 · Active for 7 years
18
Total CVEs
More Total CVEs than 93% of tracked products
3.6
Avg CVEs / Year
Higher CVE frequency than 83% of tracked products
7.5
Avg CVSS
Higher Avg CVSS than 49% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Fluent Bit over time
Volume of CVEsAvg CVSS Base Score
First CVE
Mar 13, 2019
7 years ago
Most Recent CVE
Nov 24, 2025
244 days ago
CVE Severity & Scoring
Fluent Bit18 CVEs
28%
56%
17%
All CVEs352,719 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local5 (27.8%)
Network13 (72.2%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low17 (94.4%)
High1 (5.6%)
Unknown0 (0.0%)
User Interaction
None14 (77.8%)
Unknown0 (0.0%)
Required4 (22.2%)
Privileges Required
Low4 (22.2%)
High0 (0.0%)
None14 (77.8%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (18 CVEs).
18 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-4323CRITICAL A memory corruption vulnerability in Fluent Bit versions 2.0.7 thru 3.0.3. This issue lies in the embedded http server’s parsing of trace requests and may result in denial of servi | May 20, 2024 | 9.8 | 48 | NO | NO |
CVE-2025-12970HIGH The extract_name function in Fluent Bit in_docker input plugin copies container names into a fixed size stack buffer without validating length. An attacker who can create container | Nov 24, 2025 | 8.8 | 31 | NO | NO |
CVE-2025-12977CRITICAL Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the ability to write records into Splunk or El | Nov 24, 2025 | 9.1 | 30 | NO | NO |
CVE-2021-36088CRITICAL Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb_free (called from flb_parser_json_do and flb_parser_do). | Jul 1, 2021 | 9.8 | 29 | NO | NO |
CVE-2021-46879HIGH An issue was discovered in Treasure Data Fluent Bit 1.7.1, a wrong variable is used to get the msgpack data resulting in a heap overflow in flb_msgpack_gelf_value_ext. An attacker | Apr 11, 2023 | 7.8 | 25 | NO | NO |
CVE-2025-12969MEDIUM Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditions. This allows remote attackers with n | Nov 24, 2025 | 6.5 | 24 | NO | NO |
CVE-2024-50609HIGH An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 an | Feb 18, 2025 | 7.5 | 24 | NO | NO |
CVE-2024-50608HIGH An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet with Content-Le | Feb 18, 2025 | 7.5 | 24 | NO | NO |
CVE-2020-35963HIGH flb_gzip_compress in flb_gzip.c in Fluent Bit before 1.6.4 has an out-of-bounds write because it does not use the correct calculation of the maximum gzip data-size expansion. | Jan 3, 2021 | 7.8 | 24 | NO | NO |
CVE-2025-12972MEDIUM Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct | Nov 24, 2025 | 5.3 | 23 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (18 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (18 CVEs).
Media Mentions
Signals from CVEs in this product scope (18 CVEs).
Top CNAs Publishing CVEs For Fluent Bit
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 4.1.0 | 5 | 7.0 | 0.7% | 0 | 0 |
| 3.1.9 | 2 | 7.5 | 1.1% | 0 | 0 |
| 2.2.2 | 1 | 7.5 | 0.7% | 0 | 0 |
| 1.7.1 | 2 | 7.8 | 0.4% | 0 | 0 |
| 1.6.10 | 1 | 7.5 | 2.0% | 0 | 0 |