Vulnerability · Published May 20, 2024 · Assigned by tenable
CVE-2024-4323Fluent Bit Memory Corruption Vulnerability
Critical 9.8
In plain English
A critical-severity heap buffer overflow in Fluent Bit from Fluent Bit. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 27.0% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)27.0%top 1.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
A memory corruption vulnerability in Fluent Bit versions 2.0.7 thru 3.0.3. This issue lies in the embedded http server’s parsing of trace requests and may result in denial of service conditions, information disclosure, or remote code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fluent Bit | Fluent Bit | 2.0.7 – through 3.0.3 |
Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H