Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-61674: Fluent Bit may allow remote code execution via crafted PONG
CVE-2026-61674 · published 4 days ago
Summary
Versions of Fluent Bit from 0.11.0 through 5.0.8 can be tricked into running malicious code if an attacker sends an overly long response during the secure‑forward handshake. The problem occurs when the software copies the server’s reply into a small fixed‑size buffer without checking its size. Update Fluent Bit to version 5.0.8 or newer to fix the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| fluent | fluent-bit | >= 0.11.0, < 5.0.8 |
Original advisory text
Fluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handler
Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Linux, BSD, macOS, and Windows. From 0.11.0 until 5.0.8, plugins/out_forward/forward.c secure_forward_pong copies the server-controlled PONG[2] reason into the 32-byte stack buffer msg with memcpy without checking its MessagePack type or length. An attacker who controls or can impersonate an out_forward Secure Forward destination configured with Shared_Key or Empty_Shared_Key can send an oversized reason during the first handshake and overwrite stack control data. Protected builds reliably terminate, while builds without a stack canary or with a disclosure can allow remote code execution as the Fluent Bit process user. When the opt-in --supervisor mode is used, fork-only respawns preserve the canary and address layout, allowing repeated crash-or-survive probes to support code execution on a hardened build; ordinary exec-based or service-manager restarts do not preserve that state. This issue is fixed in version 5.0.8.
References
- https://github.com/fluent/fluent-bit/security/advisories/GHSA-jrp8-r9hx-gf73 Vendor Advisory
- https://github.com/fluent/fluent-bit/pull/11945 Patch
- https://github.com/fluent/fluent-bit/commit/45486556be9d023e194665e243f156b228e1... Patch
- https://github.com/fluent/fluent-bit/releases/tag/v5.0.8 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61674... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-61674 Vendor Advisory
Severity
9.9
Critical
Exploitation
EPSS <1%
Type
CWE-121Stack-based Buffer Overflow
CWE-787Out-of-bounds Write
CWE-843Type Confusion
Timeline
Published21 Sep 2026
Updated26 Sep 2026
First seen21 Sep 2026
Track software like this
Free during beta