{"id":"CVE-2024-4323","state":"PUBLISHED","title":"Fluent Bit Memory Corruption Vulnerability","description":"A memory corruption vulnerability in Fluent Bit versions 2.0.7 thru 3.0.3. This issue lies in the embedded http server’s parsing of trace requests and may result in denial of service conditions, information disclosure, or remote code execution.","publishedAt":"2024-05-20T12:06:21.696Z","updatedAt":"2024-08-19T07:47:45.924Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"tenable"},"assigner":"tenable","products":["Fluent Bit Fluent Bit"],"affected":[{"vendor":"Fluent Bit","product":"Fluent Bit","defaultStatus":"unaffected","versions":[{"version":"2.0.7","status":"affected","lessThanOrEqual":"3.0.3","versionType":"semver"}],"repo":"https://github.com/fluent/fluent-bit"}],"references":["https://tenable.com/security/research/tra-2024-17","https://github.com/fluent/fluent-bit/commit/9311b43a258352797af40749ab31a63c32acfd04","https://www.vicarius.io/vsociety/posts/linguistic-lumberjack-memory-corruption-in-fluent-bit-cve-2024-4323"],"weaknesses":["CWE-122"],"ingestedAt":"2026-10-29T20:07:56.516Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/4xxx/CVE-2024-4323.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-4323","state":"PUBLISHED","datePublished":"2024-05-20T12:06:21.696Z","dateUpdated":"2024-08-19T07:47:45.924Z","assignerShortName":"tenable","assignerOrgId":"5ac1ecc2-367a-4d16-a0b2-35d495ddd0be","dateReserved":"2024-04-29T18:39:50.531Z"},"containers":{"cna":{"title":"Fluent Bit Memory Corruption Vulnerability","descriptions":[{"lang":"en","value":"A memory corruption vulnerability in Fluent Bit versions 2.0.7 thru 3.0.3. This issue lies in the embedded http server’s parsing of trace requests and may result in denial of service conditions, information disclosure, or remote code execution."}],"affected":[{"vendor":"Fluent Bit","product":"Fluent Bit","defaultStatus":"unaffected","versions":[{"version":"2.0.7","status":"affected","lessThanOrEqual":"3.0.3","versionType":"semver"}],"repo":"https://github.com/fluent/fluent-bit"}],"references":[{"url":"https://tenable.com/security/research/tra-2024-17"},{"url":"https://github.com/fluent/fluent-bit/commit/9311b43a258352797af40749ab31a63c32acfd04"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-122","description":"CWE-122 Heap-based Buffer Overflow","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"tenable","orgId":"5ac1ecc2-367a-4d16-a0b2-35d495ddd0be","dateUpdated":"2024-07-01T17:07:24.703Z"},"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"A fix for this issue is introduced in versions 2.2.3 and 3.0.4.<br>"}],"value":"A fix for this issue is introduced in versions 2.2.3 and 3.0.4."}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"treasuredata","product":"fluent_bit","defaultStatus":"unknown","versions":[{"version":"2.0.7","status":"affected","lessThanOrEqual":"3.0.3","versionType":"semver"}],"cpes":["cpe:2.3:a:treasuredata:fluent_bit:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-4323","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2024-05-20T14:38:35.183635Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:54:53.868Z"}},{"title":"CVE Program Container","references":[{"url":"https://tenable.com/security/research/tra-2024-17","tags":["x_transferred"]},{"url":"https://github.com/fluent/fluent-bit/commit/9311b43a258352797af40749ab31a63c32acfd04","tags":["x_transferred"]},{"url":"https://www.vicarius.io/vsociety/posts/linguistic-lumberjack-memory-corruption-in-fluent-bit-cve-2024-4323"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-19T07:47:45.924Z"}}]}}}