CVE-2025-0913 vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, kubeflow-katib, go...

GHSA-JW54-C8RR-PJPQ vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, kubeflow-katib, go...

GHSA-JW54-C8RR-PJPQ vulnerabilities

Vulnerabilities for packages: nvidia-nsight-compute-12.9, nvidia-nsight-compute-12.8, go, newrelic-fluent-bit-output, nvidia-nsight-compute-13.0, nvidia-nsight-compute-13.1, kubeflow-katib...

CVE-2025-0913 vulnerabilities

Vulnerabilities for packages: nvidia-nsight-compute-12.9, nvidia-nsight-compute-12.8, go, newrelic-fluent-bit-output, nvidia-nsight-compute-13.0, nvidia-nsight-compute-13.1, kubeflow-katib...

CVE-2025-12969 affecting package fluent-bit for versions less than 3.1.10-3

CVE-2025-12969 affecting package fluent-bit for versions less than 3.1.10-3. A patched version of the package is available...

CVE-2025-12977 affecting package fluent-bit for versions less than 3.1.10-3

CVE-2025-12977 affecting package fluent-bit for versions less than 3.1.10-3. A patched version of the package is available...

BIT-FLUENT-BIT-2025-29478

An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the cfllistsize in cfllist.h:165...

BIT-FLUENT-BIT-2025-29477

An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consumeevent...

AZL-71854 CVE-2025-62408 affecting package fluent-bit for versions less than 3.1.10-4

c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using readanswer and processanswer, which can cause a Denial of Service. This issue is fixed in version 1.34.6...

CVE-2025-12970 affecting package fluent-bit for versions less than 3.1.10-2

CVE-2025-12970 affecting package fluent-bit for versions less than 3.1.10-2. A patched version of the package is available...

CVE-2025-12970 affecting package fluent-bit for versions less than 3.0.6-5

CVE-2025-12970 affecting package fluent-bit for versions less than 3.0.6-5. A patched version of the package is available...

CVE-2025-12977 affecting package fluent-bit for versions less than 3.0.6-6

CVE-2025-12977 affecting package fluent-bit for versions less than 3.0.6-6. A patched version of the package is available...

CVE-2025-12969 affecting package fluent-bit for versions less than 3.0.6-6

CVE-2025-12969 affecting package fluent-bit for versions less than 3.0.6-6. A patched version of the package is available...

BIT-FLUENT-BIT-2025-12978 CVE-2025-12978

Fluent Bit inhttp, insplunk, and inelasticsearch input plugins contain a flaw in the tagkey validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote attacker with authenticated or exposed acces...

BIT-FLUENT-BIT-2025-12977 CVE-2025-12977

Fluent Bit inhttp, insplunk, and inelasticsearch input plugins fail to sanitize tagkey inputs. An attacker with network access or the ability to write records into Splunk or Elasticsearch can supply tagkey values containing special characters such as newlines or ../ that are treated as valid tags...

BIT-FLUENT-BIT-2025-12972 CVE-2025-12972

Fluent Bit outfile plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause...

BIT-FLUENT-BIT-2025-12970 CVE-2025-12970

The extractname function in Fluent Bit indocker input plugin copies container names into a fixed size stack buffer without validating length. An attacker who can create containers or control container names, can supply a long name that overflows the buffer, leading to process crash or arbitrary...

BIT-FLUENT-BIT-2025-12969 CVE-2025-12969

Fluent Bit inforward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditions. This allows remote attackers with network access to the Fluent Bit instance exposing the forward input to send unauthenticated data. By bypassing...

Fluent Bit < 4.0.12 / 4.1.x < 4.1.1 Multiple Vulnerabilities

The version of Fluent Bit running on the remote host is prior to 4.0.12, or 4.1.x prior to 4.1.1. It is, therefore, affected by multiple vulnerabilities, including: - Fluent Bit inhttp, insplunk, and inelasticsearch input plugins fail to sanitize tagkey inputs. An attacker with network access or...

CVE-2025-12978

Fluent Bit inhttp, insplunk, and inelasticsearch input plugins contain a flaw in the tagkey validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote attacker with authenticated or exposed acces...