CVE-2024-23722

🗓️ 26 Mar 2024 00:00:00Reported by mitreType

cve

cve🔗 web.nvd.nist.gov👁 63 Views🌐 WEB

Fluent Bit NULL pointer dereference in HTT

Reporter	Title	Published	Views	Family All 26
GithubExploit	Exploit for NULL Pointer Dereference in Treasuredata Fluent_Bit	25 Mar 202417:50	–	githubexploit
CBLMariner	CVE-2024-23722 affecting package fluent-bit for versions less than 2.2.2-1	10 Apr 202421:48	–	cbl_mariner
CNNVD	Fluent Bit 安全漏洞	26 Mar 202400:00	–	cnnvd
Cvelist	CVE-2024-23722	26 Mar 202400:00	–	cvelist
Tenable Nessus	CBL Mariner 2.0 Security Update: fluent-bit (CVE-2024-23722)	23 Apr 202400:00	–	nessus
Tenable Nessus	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.10 : Netdata vulnerabilities (USN-7250-1)	3 Feb 202500:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2024-23722	2 Sep 202500:00	–	nessus
Microsoft CVE	In Fluent Bit 2.1.8 through 2.2.1 a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It crashes and does not restart. This could result in logs not being delivered properly.	1 Apr 202407:00	–	mscve
NCSC	Vulnerabilities fixed in Microsoft Mariner	13 Aug 202418:23	–	ncsc
NVD	CVE-2024-23722	26 Mar 202415:15	–	nvd

NVD

Vulnrichment

Node

treasuredata fluent_bitRange2.1.8–2.2.2

Source	Link
medium	www.medium.com/%40adurands82/fluent-bit-dos-vulnerability-cve-2024-23722-4e3e74af9d00
github	www.github.com/fluent/fluent-bit/compare/v2.2.1...v2.2.2

Parameter	Position	Path	Description	CWE
Content-Type	request body	127.0.0.1:8888	NULL pointer dereference via invalid HTTP x-www-form-urlencoded payload leading to crash	CWE-476
payload	request body	127.0.0.1:8888	NULL pointer dereference via invalid HTTP x-www-form-urlencoded payload leading to crash	CWE-476

30 Apr 2025 16:48Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.17.5

EPSS0.00879

SSVC

fluent bit null pointer http payload x-www-form-urlencoded crash logs delivery