Executive brief
Fluent Bit is a logging and metrics processor used in production infrastructure to collect and forward data. An attacker who controls a destination server that Fluent Bit connects to can send a malformed message during the connection handshake, causing a buffer overflow that can crash the service or execute arbitrary code with Fluent Bit's privileges.
Technical details
The secure_forward_pong function in plugins/out_forward/forward.c copies a server-controlled PONG reason field into a 32-byte stack buffer using memcpy without validating the MessagePack type or length, leading to a classic stack-based buffer overflow. An unauthenticated attacker who can control or impersonate an out_forward Secure Forward destination (configured with Shared_Key or Empty_Shared_Key) can trigger this during the initial handshake. The vulnerability allows remote code execution on unprotected builds; hardened builds with stack canaries and ASLR are partially exploitable via repeated restarts in supervisor mode.
Affected products
- Fluent Fluent Bit 0.11.0 through 5.0.7
Timeline
- 2026-09-21: disclosed
- 2026-06-15: patched: Fix committed; version 5.0.8 released with patches