Log in Start free

Vulnerability · Published Nov 24, 2025 · Assigned by certcc

CVE-2025-12977CVE-2025-12977

Critical 9.1

In plain English

A critical-severity security flaw in Fluent Bit from FluentBit. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.8%top 44.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the ability to write records into Splunk or Elasticsearch can supply tag_key values containing special characters such as newlines or ../ that are treated as valid tags. Because tags influence routing and some outputs derive filenames or contents from tags, this can allow newline injection, path traversal, forged record injection, or log misrouting, impacting data integrity and log routing.

Affected products (as reported)

VendorProductVersions
FluentBit Fluent Bit 0 – before 4.0.12

Weakness: CWE-1287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References