{"id":"CVE-2020-35963","details":"flb_gzip_compress in flb_gzip.c in Fluent Bit before 1.6.4 has an out-of-bounds write because it does not use the correct calculation of the maximum gzip data-size expansion.","aliases":["BIT-fluent-bit-2020-35963"],"modified":"2026-04-11T13:53:10.034741Z","published":"2021-01-03T19:15:11.673Z","references":[{"type":"ADVISORY","url":"https://fluentbit.io/announcements/v1.6.4/"},{"type":"REPORT","url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27261"},{"type":"FIX","url":"https://github.com/fluent/fluent-bit/commit/cadff53c093210404aed01c4cf586adb8caa07af"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/fluent/fluent-bit","events":[{"introduced":"0"},{"fixed":"626b22f1dff69c155a2d84df7625c58b78881eeb"},{"fixed":"cadff53c093210404aed01c4cf586adb8caa07af"}],"database_specific":{"versions":[{"introduced":"0"},{"fixed":"1.6.4"}]}}],"versions":["0.13-dev-0.10","0.13-dev-0.11","0.13-dev-0.12","0.13-dev-0.13","0.13-dev-0.14","0.13-dev-0.15","0.13-dev-0.16","0.13-dev-0.17","0.13-dev-0.18","0.13-dev-0.4","0.13-dev-0.9","v0.10.0","v0.11.0","v0.12.0","v0.12.1","v0.12.2","v0.12.3","v0.12.4","v0.13.0","v0.14.0","v0.3","v0.4","v0.5","v0.5.1","v0.6.0","v0.7.0","v0.8.0","v0.8.1","v0.8.2","v0.9.0","v1.0.0","v1.1.0","v1.2.0","v1.3.0","v1.4.0","v1.5.0","v1.6.0","v1.6.1","v1.6.2","v1.6.3"],"database_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"302333153565315774508503202736230264542","length":1168},"id":"CVE-2020-35963-2595e37e","signature_type":"Function","signature_version":"v1","source":"https://github.com/fluent/fluent-bit/commit/626b22f1dff69c155a2d84df7625c58b78881eeb","target":{"function":"test_sts_provider_api_error","file":"tests/internal/aws_credentials_sts.c"}},{"digest":{"function_hash":"77048056922639755535802814914479255142","length":1656},"id":"CVE-2020-35963-2bda8d04","signature_type":"Function","signature_version":"v1","source":"https://github.com/fluent/fluent-bit/commit/626b22f1dff69c155a2d84df7625c58b78881eeb","target":{"file":"tests/internal/aws_credentials_sts.c","function":"test_sts_provider"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/fluent/fluent-bit/commit/626b22f1dff69c155a2d84df7625c58b78881eeb","target":{"file":"tests/internal/aws_credentials_sts.c","function":"test_sts_provider_unexpected_api_response"},"deprecated":false,"digest":{"length":1225,"function_hash":"193202644905934632633886159497632325100"},"id":"CVE-2020-35963-4815c013","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["124735178251830900871491375568048314504","293622293194209887123959125400464257060","120939548274153104331139632533530568629","54306140510477136175755562999182789446","277021983509763747482207259127212161181","152989603011667552483711257643298154630","312494415219487269529278744742529149872","278295091071519183037175122725760081614","124735178251830900871491375568048314504","293622293194209887123959125400464257060","120939548274153104331139632533530568629","54306140510477136175755562999182789446","124735178251830900871491375568048314504","293622293194209887123959125400464257060","120939548274153104331139632533530568629","54306140510477136175755562999182789446","277021983509763747482207259127212161181","152989603011667552483711257643298154630","312494415219487269529278744742529149872","278295091071519183037175122725760081614","124735178251830900871491375568048314504","293622293194209887123959125400464257060","120939548274153104331139632533530568629","54306140510477136175755562999182789446","277021983509763747482207259127212161181","152989603011667552483711257643298154630","312494415219487269529278744742529149872","278295091071519183037175122725760081614","124735178251830900871491375568048314504","293622293194209887123959125400464257060","120939548274153104331139632533530568629","54306140510477136175755562999182789446","124735178251830900871491375568048314504","293622293194209887123959125400464257060","120939548274153104331139632533530568629","54306140510477136175755562999182789446","124735178251830900871491375568048314504","293622293194209887123959125400464257060","120939548274153104331139632533530568629","54306140510477136175755562999182789446","39841690865401529696043477842857335448","58115453181828316769903993001829882048","74256574215574336428172966280006597954","176078921011120848351910237683021557823"],"threshold":0.9},"id":"CVE-2020-35963-50be23e5","signature_type":"Line","signature_version":"v1","source":"https://github.com/fluent/fluent-bit/commit/626b22f1dff69c155a2d84df7625c58b78881eeb","target":{"file":"tests/internal/aws_credentials_sts.c"}},{"deprecated":false,"digest":{"function_hash":"13215181864013254412438448372055788786","length":1485},"id":"CVE-2020-35963-6169565b","signature_type":"Function","signature_version":"v1","source":"https://github.com/fluent/fluent-bit/commit/626b22f1dff69c155a2d84df7625c58b78881eeb","target":{"function":"test_eks_provider","file":"tests/internal/aws_credentials_sts.c"}},{"signature_version":"v1","source":"https://github.com/fluent/fluent-bit/commit/626b22f1dff69c155a2d84df7625c58b78881eeb","target":{"file":"tests/internal/aws_credentials_sts.c","function":"test_eks_provider_api_error"},"deprecated":false,"digest":{"function_hash":"10197313747727121921242795550451454598","length":906},"id":"CVE-2020-35963-67a32269","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/fluent/fluent-bit/commit/626b22f1dff69c155a2d84df7625c58b78881eeb","target":{"file":"tests/internal/aws_credentials_sts.c","function":"test_eks_provider_random_session_name"},"deprecated":false,"digest":{"function_hash":"176501941791709427790083787017163200053","length":1402},"id":"CVE-2020-35963-7a9aa647"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/fluent/fluent-bit/commit/626b22f1dff69c155a2d84df7625c58b78881eeb","target":{"file":"tests/internal/aws_credentials_sts.c","function":"test_eks_provider_unexpected_api_response"},"deprecated":false,"digest":{"function_hash":"117810127888757996725744180303068170379","length":941},"id":"CVE-2020-35963-996d68b7"},{"digest":{"function_hash":"57581972273330664649563572033679346079","length":1551},"id":"CVE-2020-35963-e15cec1a","signature_type":"Function","signature_version":"v1","source":"https://github.com/fluent/fluent-bit/commit/cadff53c093210404aed01c4cf586adb8caa07af","target":{"file":"src/flb_gzip.c","function":"flb_gzip_compress"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["78104538685687191706812304235110739877","115090620069431853279167780948713951302","189634672769753926143120117205069540212","21512769843125165463443561585067901613","319455758311923949884162954932813695046"],"threshold":0.9},"id":"CVE-2020-35963-ed34a5e6","signature_type":"Line","signature_version":"v1","source":"https://github.com/fluent/fluent-bit/commit/cadff53c093210404aed01c4cf586adb8caa07af","target":{"file":"src/flb_gzip.c"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-35963.json","vanir_signatures_modified":"2026-04-11T13:53:10Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}