CVE-2026-61674
Received Received - Intake

Stack-Based Buffer Overflow in Fluent Bit

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Linux, BSD, macOS, and Windows. From 0.11.0 until 5.0.8, plugins/out_forward/forward.c secure_forward_pong copies the server-controlled PONG[2] reason into the 32-byte stack buffer msg with memcpy without checking its MessagePack type or length. An attacker who controls or can impersonate an out_forward Secure Forward destination configured with Shared_Key or Empty_Shared_Key can send an oversized reason during the first handshake and overwrite stack control data. Protected builds reliably terminate, while builds without a stack canary or with a disclosure can allow remote code execution as the Fluent Bit process user. When the opt-in --supervisor mode is used, fork-only respawns preserve the canary and address layout, allowing repeated crash-or-survive probes to support code execution on a hardened build; ordinary exec-based or service-manager restarts do not preserve that state. This issue is fixed in version 5.0.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-61674
EUVD
EUVD-2026-83985

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
fluent fluent_bit 5.0.8
fluent fluent_bit From 0.11.0 (inc) to 5.0.8 (inc)
fluent_bit fluent_bit to 5.0.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-843 The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack buffer overflow in Fluent Bit's out_forward plugin during the Secure Forward handshake. An attacker controlling a destination server can send an oversized PONG reason string, overwriting stack control data. This may lead to remote code execution or denial-of-service depending on build configurations.

Detection Guidance

Check Fluent Bit version with `fluent-bit --version`; if below 5.0.8, it is vulnerable. Monitor logs for crashes in the out_forward plugin or unusual PONG responses. Use network traffic analysis tools like Wireshark to inspect Secure Forward handshake messages for oversized PONG reasons.

Impact Analysis

If exploited, this flaw allows remote attackers to execute arbitrary code or crash Fluent Bit processes. Systems using Secure Forward with Shared_Key or Empty_Shared_Key authentication are vulnerable. Attackers can compromise entire fleets if a single aggregator is compromised.

Compliance Impact

This vulnerability could lead to unauthorized remote code execution or denial-of-service attacks on systems processing sensitive data, potentially violating GDPR's integrity and confidentiality requirements or HIPAA's security rules for protected health information. A successful exploit may result in data breaches, unauthorized access, or service disruptions, all of which are critical compliance violations.

Mitigation Strategies

Upgrade Fluent Bit to version 5.0.8 or later immediately. Disable Secure Forward with Shared_Key or Empty_Shared_Key if not required. Enable TLS peer verification for all forward destinations. Avoid using --supervisor mode until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61674. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart