# CVE-2025-12970: The extract_name function in Fluent Bit in_docker input plugin copies container names into a fixed size stack buffer…

Source: https://junglewise.ai/threats/cve-2025-12970-the-extract-name-function-in-fluent-bit-in-docker-input-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-24  
License: CC BY 4.0 with a link back

CVE-2025-12970 · Severity: high · CVSS 8.8 · Published 2025-11-24

The extract_name function in Fluent Bit in_docker input plugin copies container names into a fixed size stack buffer without validating length. An attacker who can create containers or control container names, can supply a long name that overflows the buffer, leading to process crash or arbitrary code execution.

Technologies: [Treasuredata Fluent Bit](https://junglewise.ai/threats/technologies/treasuredata-fluent-bit). Vendors: [Treasuredata](https://junglewise.ai/threats/vendors/treasuredata).

## Quick answers

**Is CVE-2025-12970 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-12970 being exploited in the wild.

**How severe is CVE-2025-12970?** High severity, with a CVSS score of 8.8, published 24 November 2025.

**Which products and versions are affected?** Treasuredata Fluent Bit. The advisory does not name versions.

**Is there a fix for CVE-2025-12970?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-12970?** Check whether you run Treasuredata Fluent Bit. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Treasuredata Fluent Bit

## Related threats

- [Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that…](https://junglewise.ai/threats/cve-2025-12978-fluent-bit-in-http-in-splunk-and-in-elasticsearch-input-plugins)
- [Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with…](https://junglewise.ai/threats/cve-2025-12977-fluent-bit-in-http-in-splunk-and-in-elasticsearch-input-plugins)
- [Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option…](https://junglewise.ai/threats/cve-2025-12972-fluent-bit-out-file-plugin-does-not-properly-sanitize-tag-values)
- [Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain…](https://junglewise.ai/threats/cve-2025-12969-fluent-bit-in-forward-input-plugin-does-not-properly-enforce-the)