CVE-2026-61674
- Source
- https://cve.org/CVERecord?id=CVE-2026-61674
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61674.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-61674
- Aliases
-
- GHSA-jrp8-r9hx-gf73
- Published
- 2026-09-21T16:10:15Z
- Modified
- 2026-09-26T08:08:50Z
- Severity
-
- 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Fluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handler
- Details
-
Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Linux, BSD, macOS, and Windows. From 0.11.0 until 5.0.8, plugins/out_forward/forward.c secure_forward_pong copies the server-controlled PONG[2] reason into the 32-byte stack buffer msg with memcpy without checking its MessagePack type or length. An attacker who controls or can impersonate an out_forward Secure Forward destination configured with Shared_Key or Empty_Shared_Key can send an oversized reason during the first handshake and overwrite stack control data. Protected builds reliably terminate, while builds without a stack canary or with a disclosure can allow remote code execution as the Fluent Bit process user. When the opt-in --supervisor mode is used, fork-only respawns preserve the canary and address layout, allowing repeated crash-or-survive probes to support code execution on a hardened build; ordinary exec-based or service-manager restarts do not preserve that state. This issue is fixed in version 5.0.8.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-121", "CWE-787", "CWE-843" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61674.json" }- References
-
- https://github.com/fluent/fluent-bit/releases/tag/v5.0.8
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61674.json
- https://github.com/fluent/fluent-bit/security/advisories/GHSA-jrp8-r9hx-gf73
- https://nvd.nist.gov/vuln/detail/CVE-2026-61674
- https://github.com/fluent/fluent-bit/commit/45486556be9d023e194665e243f156b228e195e0
- https://github.com/fluent/fluent-bit/pull/11945
Affected packages
Git / github.com/fluent/fluent-bit
Affected versions
0.*
0.13-dev-0.10
0.13-dev-0.11
0.13-dev-0.12
0.13-dev-0.13
0.13-dev-0.14
0.13-dev-0.15
0.13-dev-0.16
0.13-dev-0.17
0.13-dev-0.18
0.13-dev-0.4
0.13-dev-0.9
Other
ci-release-test
unstable
unstable-master
tiger-2.*
tiger-2.0.9-dev-20230104
v0.*
v0.11.0
v0.12.0
v0.12.1
v0.12.2
v0.12.3
v0.12.4
v0.13.0
v0.14.0
v1.*
v1.0.0
v1.1.0
v1.2.0
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.7.0-rc1
v1.7.0-rc2
v1.7.0-rc3
v1.7.0-rc4
v1.7.0-rc5
v1.7.0-rc6
v1.7.0-rc7
v1.7.0-rc8
v1.7.0-rc9
v1.8.0
v1.8.0-rc1
v1.9.0
v1.9.0-ci-test-1
v1.9.0-rc1
v1.9.0-rc2
v1.9.0-rc3
v1.9.0-rc4
v1.9.1
v1.9.2
v1.9.3
v1.9.4
v1.9.5
v1.9.6
v2.*
v2.0.0
v2.0.0-rc1
v2.0.0-rc2
v2.0.0-rc3
v2.0.0pre
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1.0
v2.1.0-rc1
v2.1.0-rc2
v2.1.1
v2.1.10
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.5-windows-artifact-fix
v2.1.6
v2.1.7
v2.1.8
v2.1.9
v2.2.0
v2.2.1
v2.2.2
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.1.0
v3.1.1
v3.1.2
v3.1.3
v3.1.4
v3.1.5
v3.1.6
v3.1.7
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.2.4
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.1.0
v4.1.1
v4.2.0
v4.2.1
v4.2.2
v5.*
v5.0.0
v5.0.0-dev-20260228
v5.0.1
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.0.6
v5.0.7
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61674.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "12108562475772881741532891764533895758",
"length": 831
},
"id": "CVE-2026-61674-6aeb5a7b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/fluent/fluent-bit/commit/45486556be9d023e194665e243f156b228e195e0",
"target": {
"file": "plugins/out_forward/forward.c",
"function": "secure_forward_set_ping"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "202580553461003398856554670685314821884",
"length": 1704
},
"id": "CVE-2026-61674-6da193c9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/fluent/fluent-bit/commit/45486556be9d023e194665e243f156b228e195e0",
"target": {
"file": "plugins/out_forward/forward.c",
"function": "forward_read_ack"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"109892103368770804340707182401705068947",
"79042326205197952734309193389809295957",
"53791509545366165026941408607847513010",
"58386284950379236162245610456696594614",
"76448167896858059573139416793542022325",
"9646347850823226323252405560213345279",
"92031797753512722099273728139035897037",
"34327600128697793569377005616640631895",
"327191657499607947242031693328549411946",
"35877717473829185452322781674109525789"
],
"threshold": 0.9
},
"id": "CVE-2026-61674-962fabdd",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/fluent/fluent-bit/commit/c2b1cfd5f5b3530d613c167fc999a7df4eb2eabb",
"target": {
"file": "lib/cmetrics/src/cmt_decode_prometheus_remote_write.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "139795757742715157447433011366250549793",
"length": 876
},
"id": "CVE-2026-61674-a1dcc11f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/fluent/fluent-bit/commit/c2b1cfd5f5b3530d613c167fc999a7df4eb2eabb",
"target": {
"file": "lib/cmetrics/src/cmt_decode_prometheus.c",
"function": "cmt_decode_prometheus_create"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "78830882760712721595485898237237393292",
"length": 1006
},
"id": "CVE-2026-61674-a2337c01",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/fluent/fluent-bit/commit/45486556be9d023e194665e243f156b228e195e0",
"target": {
"file": "plugins/out_forward/forward.c",
"function": "secure_forward_pong"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"2236545564999801333581505659192214073",
"201516507790519433390318805791342020733",
"247710377893436769851124817321464765799",
"115521225942861320631387540073660167967",
"279624703043579338860214166225171186129",
"242115209420296492577959592077701393093",
"208274117370631876017412880607517915816",
"88122279482870993490985441874507289111",
"186870409397564609632930107061733648091",
"30680502031983873664112199382512120823",
"127057233698566587093684450402307153477",
"132394222075012732633440801415777714207",
"292754952289726580906954304926877358676"
],
"threshold": 0.9
},
"id": "CVE-2026-61674-b4bab19a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/fluent/fluent-bit/commit/c2b1cfd5f5b3530d613c167fc999a7df4eb2eabb",
"target": {
"file": "lib/cmetrics/src/cmt_decode_prometheus.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "154571763559781571997563238476401176408",
"length": 1589
},
"id": "CVE-2026-61674-c3ac0f0d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/fluent/fluent-bit/commit/45486556be9d023e194665e243f156b228e195e0",
"target": {
"file": "plugins/out_forward/forward.c",
"function": "secure_forward_handshake"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"143694583427758237180392002332724715051",
"80167433658626679040363383698335981877",
"224373246246698353555485726676826643808",
"118271699908511174797138905478693358289",
"326759896147542111302863522927662231056",
"274769053494037376438522819438729055929",
"153928645652650931822543917491889915199",
"26836979787803420253521286003987757473",
"72845306340318670368591796975851325429",
"244438658424455644817377425651836054476",
"318009513800416118651723063443201228293",
"187801562467765090336861904254313802997",
"268005190156082417025579244335276215102",
"336061669127830509219848702918369415139",
"293018577182181819532955073691601654175",
"113887318753380187469334822980151035023",
"47346127065266077532348461519738686226",
"102262355392700506018615707593069365141",
"2464577437898613312907633069306888102",
"70570181107883549807842010019855916645",
"329111864050100599973362329454031941008",
"186869220335632160812982209389291229080",
"228026825737503554291373475302703753080",
"94270047563796469897220570572197403048",
"136316530932655641159658606733119732245",
"302033572867124347196042259311229638439",
"260307563047875793806138233199470654916",
"224915232896602672509953074729028655278",
"301163491735378503680751546369220315827",
"220452027887654026037246640944052088769",
"126682241143480317532660375434391247647",
"209017345906937014886526351245140565304",
"116886150220567370795547417591163248982",
"189534114266655123264115306858011346793",
"190168452005905796244451379643208409716",
"100251641557487974672757984781778665557",
"114697008718774793558979909193144335323",
"20978597215160985673376804774703541743",
"116957830503621857291908060707094803059",
"237245067694195830465523749070627065255",
"180995102303293837858635702898358282885",
"45686389741131382979586028086909279374",
"178622851493511465217169351187999591116",
"309152141581418026043649564263153765041",
"270149128405427154853569000229124275244",
"183894150171563600911249260039748911431",
"210170547277485559144040285991918259943",
"105473233043300479719276830256131764297",
"282733584256227042099863182187584736009",
"50702711648885432873757465152904358180",
"210187921317907964002389914837138711271",
"174755832052620768203621782632293499293",
"197923971275149008464745735185388630697",
"323668589432499207352822821816316561048"
],
"threshold": 0.9
},
"id": "CVE-2026-61674-caa6b7da",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/fluent/fluent-bit/commit/45486556be9d023e194665e243f156b228e195e0",
"target": {
"file": "plugins/out_forward/forward.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "24479201075662030148305761665135551105",
"length": 5209
},
"id": "CVE-2026-61674-d62d3053",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/fluent/fluent-bit/commit/c2b1cfd5f5b3530d613c167fc999a7df4eb2eabb",
"target": {
"file": "lib/cmetrics/src/cmt_decode_prometheus_remote_write.c",
"function": "decode_histogram_points"
}
}
]
vanir_signatures_modified
"2026-09-26T08:08:50Z"