CVE-2024-4323 in the critical feed json
Fluent Bit Memory Corruption Vulnerability
published 2024-05-20 2 y ago modified 2026-09-08 2 mo ago also BIT-fluent-bit-2024-4323 , EUVD-2024-43966
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 27.2%
- EPSS 27.2% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known
Summary
A memory corruption vulnerability in Fluent Bit versions 2.0.7 thru 3.0.3. This issue lies in the embedded http server’s parsing of trace requests and may result in denial of service conditions, information disclosure, or remote code execution.
Patch / fix
- bitnami fluent-bit 3.0.4
- treasuredata fluent_bit 3.0.4
- fluent-bit Azure Linux 3.0 3.0.6-1
- fluent-bit CBL-Mariner 2.0 2.2.3-1
azure linux advisories AZL-42103AZL-42162
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
27.24% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- vicarius.io https://www.vicarius.io/vsociety/posts/linguistic-lumberjack-memory-corruption-in-fluent-bit-cve-2024-4323 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | fluent-bit | >=2.0.7, <3.0.4 |
3.0.4 |
Affected products
- Fluent Bit Fluent Bit
- treasuredata fluent_bit
Classification
References
-
github.com
/fluent/fluent-bit/commit/9311b43a258352797af40749ab31a63c32acfd04
patch
-
tenable.com
/security/research/tra-2024-17
patch, third-party-advisory, advisory
-
vicarius.io
/vsociety/posts/linguistic-lumberjack-memory-corruption-in-fluent-bit-cve-2024-4323
exploit, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-4323
web
-
fluentbit.io
/announcements/v3.0.4/
web
-
fluentbit.io
/blog/2024/05/21/statement-on-cve-2024-4323-and-its-fix/
web
Sources
- CVE List CVE-2024-4323
- NVD CVE-2024-4323
- OSV BIT-fluent-bit-2024-4323
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.