{"id":"CVE-2026-61674","summary":"Fluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handler","details":"Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Linux, BSD, macOS, and Windows. From 0.11.0 until 5.0.8, plugins/out_forward/forward.c secure_forward_pong copies the server-controlled PONG[2] reason into the 32-byte stack buffer msg with memcpy without checking its MessagePack type or length. An attacker who controls or can impersonate an out_forward Secure Forward destination configured with Shared_Key or Empty_Shared_Key can send an oversized reason during the first handshake and overwrite stack control data. Protected builds reliably terminate, while builds without a stack canary or with a disclosure can allow remote code execution as the Fluent Bit process user. When the opt-in --supervisor mode is used, fork-only respawns preserve the canary and address layout, allowing repeated crash-or-survive probes to support code execution on a hardened build; ordinary exec-based or service-manager restarts do not preserve that state. This issue is fixed in version 5.0.8.","aliases":["GHSA-jrp8-r9hx-gf73"],"modified":"2026-09-26T08:08:50.349517Z","published":"2026-09-21T16:10:15.276Z","database_specific":{"cwe_ids":["CWE-121","CWE-787","CWE-843"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61674.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/fluent/fluent-bit/releases/tag/v5.0.8"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61674.json"},{"type":"ADVISORY","url":"https://github.com/fluent/fluent-bit/security/advisories/GHSA-jrp8-r9hx-gf73"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61674"},{"type":"FIX","url":"https://github.com/fluent/fluent-bit/commit/45486556be9d023e194665e243f156b228e195e0"},{"type":"FIX","url":"https://github.com/fluent/fluent-bit/pull/11945"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/fluent/fluent-bit","events":[{"introduced":"8a14f636b74706cb41c10e8cf27444abc3dc0dac"},{"fixed":"45486556be9d023e194665e243f156b228e195e0"},{"fixed":"c2b1cfd5f5b3530d613c167fc999a7df4eb2eabb"}],"database_specific":{"extracted_events":[{"introduced":"0.11.0"},{"fixed":"5.0.8"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v5.0.7","v5.0.6","v5.0.5","v5.0.4","v5.0.3","v5.0.2","v5.0.1","v5.0.0","v5.0.0-dev-20260228","v4.2.2","v4.2.1","v4.2.0","v4.1.1","v4.1.0","v4.0.4","v4.0.3","v4.0.2","v4.0.1","v4.0.0","v3.2.4","v3.2.3","v3.2.2","v3.2.1","v3.2.0","v3.1.7","v3.1.6","v3.0.4","v3.1.5","v3.1.4","v3.1.3","v3.1.2","v3.1.1","v3.1.0","v3.0.6","v3.0.5","v3.0.3","v3.0.2","v3.0.1","v3.0.0","v2.2.2","v2.2.1","v2.2.0","v2.1.9","v2.1.10","v2.1.8","v2.1.7","v2.1.6","v2.1.5-windows-artifact-fix","v2.1.5","v2.1.4","v2.1.3","v2.1.2","v2.1.1","v2.1.0","v2.1.0-rc2","v2.1.0-rc1","v2.0.9","tiger-2.0.9-dev-20230104","v2.0.8","v2.0.7","v2.0.6","v2.0.5","v2.0.4","v2.0.3","v2.0.2","v2.0.1","v2.0.0","v2.0.0pre","v2.0.0-rc3","v2.0.0-rc2","v2.0.0-rc1","v1.9.6","v1.9.5","v1.9.4","v1.9.3","v1.9.2","v1.9.1","unstable-master","v1.9.0","v1.9.0-rc4","v1.9.0-ci-test-1","v1.9.0-rc3","unstable","v1.9.0-rc2","v1.9.0-rc1","ci-release-test","v1.8.0","v1.8.0-rc1","v1.7.0","v1.7.0-rc9","v1.7.0-rc8","v1.7.0-rc7","v1.7.0-rc6","v1.7.0-rc5","v1.7.0-rc4","v1.7.0-rc3","v1.7.0-rc2","v1.7.0-rc1","v1.6.0","v1.5.0","v1.4.0","v1.3.0","v1.2.0","v1.1.0","v1.0.0","v0.14.0","v0.13.0","0.13-dev-0.18","0.13-dev-0.17","0.13-dev-0.16","0.13-dev-0.15","0.13-dev-0.14","0.13-dev-0.13","0.13-dev-0.12","0.13-dev-0.11","0.13-dev-0.10","0.13-dev-0.9","0.13-dev-0.4","v0.12.4","v0.12.3","v0.12.2","v0.12.1","v0.12.0","v0.11.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61674.json","vanir_signatures_modified":"2026-09-26T08:08:50Z","vanir_signatures":[{"target":{"function":"secure_forward_set_ping","file":"plugins/out_forward/forward.c"},"deprecated":false,"digest":{"function_hash":"12108562475772881741532891764533895758","length":831},"id":"CVE-2026-61674-6aeb5a7b","signature_type":"Function","signature_version":"v1","source":"https://github.com/fluent/fluent-bit/commit/45486556be9d023e194665e243f156b228e195e0"},{"deprecated":false,"digest":{"function_hash":"202580553461003398856554670685314821884","length":1704},"id":"CVE-2026-61674-6da193c9","signature_type":"Function","signature_version":"v1","source":"https://github.com/fluent/fluent-bit/commit/45486556be9d023e194665e243f156b228e195e0","target":{"file":"plugins/out_forward/forward.c","function":"forward_read_ack"}},{"signature_version":"v1","source":"https://github.com/fluent/fluent-bit/commit/c2b1cfd5f5b3530d613c167fc999a7df4eb2eabb","target":{"file":"lib/cmetrics/src/cmt_decode_prometheus_remote_write.c"},"deprecated":false,"digest":{"line_hashes":["109892103368770804340707182401705068947","79042326205197952734309193389809295957","53791509545366165026941408607847513010","58386284950379236162245610456696594614","76448167896858059573139416793542022325","9646347850823226323252405560213345279","92031797753512722099273728139035897037","34327600128697793569377005616640631895","327191657499607947242031693328549411946","35877717473829185452322781674109525789"],"threshold":0.9},"id":"CVE-2026-61674-962fabdd","signature_type":"Line"},{"id":"CVE-2026-61674-a1dcc11f","signature_type":"Function","signature_version":"v1","source":"https://github.com/fluent/fluent-bit/commit/c2b1cfd5f5b3530d613c167fc999a7df4eb2eabb","target":{"file":"lib/cmetrics/src/cmt_decode_prometheus.c","function":"cmt_decode_prometheus_create"},"deprecated":false,"digest":{"function_hash":"139795757742715157447433011366250549793","length":876}},{"deprecated":false,"digest":{"function_hash":"78830882760712721595485898237237393292","length":1006},"id":"CVE-2026-61674-a2337c01","signature_type":"Function","signature_version":"v1","source":"https://github.com/fluent/fluent-bit/commit/45486556be9d023e194665e243f156b228e195e0","target":{"file":"plugins/out_forward/forward.c","function":"secure_forward_pong"}},{"target":{"file":"lib/cmetrics/src/cmt_decode_prometheus.c"},"deprecated":false,"digest":{"line_hashes":["2236545564999801333581505659192214073","201516507790519433390318805791342020733","247710377893436769851124817321464765799","115521225942861320631387540073660167967","279624703043579338860214166225171186129","242115209420296492577959592077701393093","208274117370631876017412880607517915816","88122279482870993490985441874507289111","186870409397564609632930107061733648091","30680502031983873664112199382512120823","127057233698566587093684450402307153477","132394222075012732633440801415777714207","292754952289726580906954304926877358676"],"threshold":0.9},"id":"CVE-2026-61674-b4bab19a","signature_type":"Line","signature_version":"v1","source":"https://github.com/fluent/fluent-bit/commit/c2b1cfd5f5b3530d613c167fc999a7df4eb2eabb"},{"digest":{"function_hash":"154571763559781571997563238476401176408","length":1589},"id":"CVE-2026-61674-c3ac0f0d","signature_type":"Function","signature_version":"v1","source":"https://github.com/fluent/fluent-bit/commit/45486556be9d023e194665e243f156b228e195e0","target":{"file":"plugins/out_forward/forward.c","function":"secure_forward_handshake"},"deprecated":false},{"digest":{"line_hashes":["143694583427758237180392002332724715051","80167433658626679040363383698335981877","224373246246698353555485726676826643808","118271699908511174797138905478693358289","326759896147542111302863522927662231056","274769053494037376438522819438729055929","153928645652650931822543917491889915199","26836979787803420253521286003987757473","72845306340318670368591796975851325429","244438658424455644817377425651836054476","318009513800416118651723063443201228293","187801562467765090336861904254313802997","268005190156082417025579244335276215102","336061669127830509219848702918369415139","293018577182181819532955073691601654175","113887318753380187469334822980151035023","47346127065266077532348461519738686226","102262355392700506018615707593069365141","2464577437898613312907633069306888102","70570181107883549807842010019855916645","329111864050100599973362329454031941008","186869220335632160812982209389291229080","228026825737503554291373475302703753080","94270047563796469897220570572197403048","136316530932655641159658606733119732245","302033572867124347196042259311229638439","260307563047875793806138233199470654916","224915232896602672509953074729028655278","301163491735378503680751546369220315827","220452027887654026037246640944052088769","126682241143480317532660375434391247647","209017345906937014886526351245140565304","116886150220567370795547417591163248982","189534114266655123264115306858011346793","190168452005905796244451379643208409716","100251641557487974672757984781778665557","114697008718774793558979909193144335323","20978597215160985673376804774703541743","116957830503621857291908060707094803059","237245067694195830465523749070627065255","180995102303293837858635702898358282885","45686389741131382979586028086909279374","178622851493511465217169351187999591116","309152141581418026043649564263153765041","270149128405427154853569000229124275244","183894150171563600911249260039748911431","210170547277485559144040285991918259943","105473233043300479719276830256131764297","282733584256227042099863182187584736009","50702711648885432873757465152904358180","210187921317907964002389914837138711271","174755832052620768203621782632293499293","197923971275149008464745735185388630697","323668589432499207352822821816316561048"],"threshold":0.9},"id":"CVE-2026-61674-caa6b7da","signature_type":"Line","signature_version":"v1","source":"https://github.com/fluent/fluent-bit/commit/45486556be9d023e194665e243f156b228e195e0","target":{"file":"plugins/out_forward/forward.c"},"deprecated":false},{"digest":{"function_hash":"24479201075662030148305761665135551105","length":5209},"id":"CVE-2026-61674-d62d3053","signature_type":"Function","signature_version":"v1","source":"https://github.com/fluent/fluent-bit/commit/c2b1cfd5f5b3530d613c167fc999a7df4eb2eabb","target":{"file":"lib/cmetrics/src/cmt_decode_prometheus_remote_write.c","function":"decode_histogram_points"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}