CVE-2026-61674: Fluent Bit Remote Stack Buffer Overflow in Secure-Forward PONG Handler
Summary
CVE-2026-61674: Fluent Bit: Remote stack buffer overflow in Fluent Bit out_forward Secure-Forward PONG handler. Affects fluent-bit versions >= 0.11.0, < 5.0.8. Fixed in 5.0.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Fluent Bit is a fast and lightweight processor for logs, metrics, and traces, designed for various operating systems including Linux, BSD, macOS, and Windows. It is widely used for data collection and processing in cloud-native environments. The package supports multiple plugins, including the out_forward plugin, which allows for secure data forwarding. However, certain versions of Fluent Bit are vulnerable to a critical security issue that can lead to remote code execution.
Vulnerability Detail
The vulnerability arises from the out_forward plugin's handling of the Secure-Forward PONG message. Specifically, from versions 0.11.0 to 5.0.8, the secure_forward_pong function copies a server-controlled PONG reason into a 32-byte stack buffer using memcpy without validating the MessagePack type or length. An attacker controlling the Secure Forward destination can exploit this flaw by sending an oversized reason during the handshake, potentially overwriting stack control data. This could lead to remote code execution if the build lacks protective measures like a stack canary.
How To Fix
Minimum fixed version
5.0.8
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update to the patched version immediately, consider disabling the out_forward plugin or using a different logging mechanism until the update can be applied. Additionally, ensure that your network configurations limit exposure to untrusted sources that could exploit this vulnerability.
Conclusion
CVE-2026-61674 represents a significant security risk for users of Fluent Bit versions 0.11.0 to 5.0.8. It is crucial to update to version 5.0.8 or later to mitigate the risk of remote code execution. Users should also consider using Vulert to monitor their applications for vulnerabilities in real-time.
See every vulnerability recorded for fluent-bit →
FAQ
CVE-2026-61674 is a critical vulnerability in Fluent Bit that allows for remote stack buffer overflow through the Secure-Forward PONG handler.
Versions from 0.11.0 to 5.0.8 of Fluent Bit are vulnerable to this issue.
Exploitation of this vulnerability can lead to remote code execution, allowing attackers to execute arbitrary code on the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider disabling the out_forward plugin or using alternative logging methods until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for fluent-bit.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
