CVE-2025-12978

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-12978
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-12978.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-12978
Aliases
Published
2025-11-24T14:42:06.305Z
Modified
2026-07-15T01:49:07.178560462Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
Summary
CVE-2025-12978
Details

Fluent Bit inhttp, insplunk, and inelasticsearch input plugins contain a flaw in the tagkey validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote attacker with authenticated or exposed access to these input endpoints can exploit this behavior to manipulate tags and redirect records to unintended destinations. This compromises the authenticity of ingested logs and can allow injection of forged data, alert flooding and routing manipulation.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/12xxx/CVE-2025-12978.json",
    "cna_assigner": "certcc",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "4.0.12"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/fluent/fluent-bit

Affected ranges

Type
GIT
Repo
https://github.com/fluent/fluent-bit
Events
Introduced
a8bd9e4cf636710dc7ce3af9d940bb4d91e660fc
Last affected
a8bd9e4cf636710dc7ce3af9d940bb4d91e660fc
Database specific 
{
    "cpe": "cpe:2.3:a:treasuredata:fluent_bit:4.1.0:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "4.1.0"
        },
        {
            "last_affected": "4.1.0"
        }
    ]
}

Affected versions

4.*
4.1.0
v4.*
v4.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-12978.json"