PT-2025-15280 · Unknown · Fluent-Bit

Published 2025-04-07 · Updated 2025-12-06 · CVE-2025-29478

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions fluent-bit version 3.7.2

Description The issue allows a local attacker to cause a denial of service via the cfl list size in cfl list.h:165. This can be exploited to disrupt the service.

Recommendations For fluent-bit version 3.7.2, as a temporary workaround, consider restricting access to the cfl list size variable in cfl list.h:165 to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

AZL-59725

AZL-59733

BIT-FLUENT-BIT-2025-29478

CVE-2025-29478

Affected Products

Fluent-Bit

References · 10

• 🔥 https://github.com/lmarch2/poc/blob/main/fluent-bit/fluent-bit.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-29478 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-59733 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29478 · Security Note
• https://osv.dev/vulnerability/AZL-59725 · Vendor Advisory
• https://t.me/cvetracker/21030 · Telegram Post
• https://twitter.com/CVEnew/status/1909329643125059630 · Twitter Post
• https://t.me/cveNotify/132978 · Telegram Post
• https://t.me/cvedetector/22345 · Telegram Post
• https://twitter.com/threatcluster/status/1997440956170211689 · Twitter Post