Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-57086.json
JSON Data
https://api.osv.dev/v1/vulns/AZL-57086
Upstream
Published
2025-02-18T18:15:25Z
Modified
2026-04-21T04:36:50.453081Z
Summary
CVE-2024-50609 affecting package fluent-bit for versions less than 3.0.6-2
Details

An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the Content-Length) is passed to the function cflsdslen, which in turn tries to cast a NULL pointer into struct cflsds. This is related to processpayloadtracesprotong() at opentelemetryprot.c.

References

Affected packages

Azure Linux:2 / fluent-bit

Package

Name
fluent-bit
Purl
pkg:rpm/azure-linux/fluent-bit

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.6-2

Database specific

source
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-57086.json"