Skip to content
OpenAdvisories
High WID-SEC-2025-2670 5 CVEs

Fluent Bit: Mehrere Schwachstellen

Published Nov 24, 2025 · Updated Nov 25, 2025 · Revision 2 · de-DE

Summary

Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Fluent Bit ausnutzen, um Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu verursachen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.

Product

Fluent Bit ist ein Open-Source Log-Prozessor und -Forwarder in Fluentd Umgebungen.

Vulnerabilities 5

  • Critical 9.1
    CVE-2025-12977

    CVE-2025-12977

    Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the ability to write records into Splunk or Elasticsearch can supply tag_key values containing special characters such as new…

    Fluent Bit Fluent Bit fluent-bit Azure Linux
  • High 8.8
    CVE-2025-12970

    CVE-2025-12970

    The extract_name function in Fluent Bit in_docker input plugin copies container names into a fixed size stack buffer without validating length. An attacker who can create containers or control container names, can supply a long name that overflows the buffer,…

    Fluent Bit Fluent Bit fluent-bit Azure Linux
  • Medium 6.5
    CVE-2025-12969

    CVE-2025-12969

    Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditions. This allows remote attackers with network access to the Fluent Bit instance exposing the forward input to send una…

    Fluent Bit Fluent Bit fluent-bit Azure Linux
  • Medium 5.4
    CVE-2025-12978

    CVE-2025-12978

    Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote at…

    Fluent Bit Fluent Bit
  • Medium 5.3
    CVE-2025-12972

    CVE-2025-12972

    Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing …

    Fluent Bit Fluent Bit

Revision history

  1. #2

    Weitere Quelle augenommen

  2. #1

    Initiale Fassung

References