PT-2024-21382 · Unknown · Fluent-Bit

Published 2024-02-26 · Updated 2025-05-13 · CVE-2024-26455

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions fluent-bit version 2.2.2

Description The issue is a Use-After-Free vulnerability located in the /fluent-bit/plugins/custom calyptia/calyptia.c file.

Recommendations For fluent-bit version 2.2.2, consider disabling the custom calyptia plugin as a temporary workaround until a patch is available. Restrict access to the vulnerable calyptia.c file to minimize the risk of exploitation. Avoid using the affected plugin until the issue is resolved.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

AZL-35449

AZL-35472

BIT-FLUENT-BIT-2024-26455

CVE-2024-26455

Affected Products

Fluent-Bit

References · 10

• 🔥 https://github.com/LuMingYinDetect/fluent-bit_defects/blob/main/fluent-bit_detect_1.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-26455 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35472 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26455 · Security Note
• https://osv.dev/vulnerability/BIT-fluent-bit-2024-26455 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35449 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1762199721311908323 · Twitter Post
• https://t.me/cvenotify/72385 · Telegram Post
• https://twitter.com/CVEnew/status/1762180395179630842 · Twitter Post
• https://t.me/cvenotify/121728 · Telegram Post