A critical stack-based buffer overflow in Fluent Bit enables unauthenticated remote code execution, posing a severe threat to log processing infrastructure.

The vulnerability is a stack-based buffer overflow located in the secure_forward_pong function within plugins/out_forward/forward.c. An unauthenticated attacker capable of impersonating a Secure Forward destination can trigger an out-of-bounds write by sending an oversized reason field during the initial handshake, potentially leading to remote code execution.

The ability for an unauthenticated attacker to execute arbitrary code with the privileges of the Fluent Bit process represents a critical security risk. Successful exploitation could lead to full system compromise, unauthorized access to sensitive log data, or the disruption of critical observability pipelines. Given the CVSS score of 9.2, this vulnerability must be treated as a priority for immediate remediation.

Immediate Action: Upgrade Fluent Bit to version 5.0.8 or later immediately to incorporate the necessary length checks that prevent the buffer overflow.

Proactive Monitoring: Monitor network traffic for unusual handshake patterns or unexpected connection attempts to the Fluent Bit Secure Forward port, and review system logs for signs of process instability or crashes.

Compensating Controls: If immediate patching is not feasible, restrict network access to the Secure Forward interface to trusted endpoints only and implement network-level egress filtering to prevent unauthorized connections to external Fluent Bit destinations.

Public Exploit Available: Unknown

The severity of this vulnerability, combined with the potential for remote code execution, necessitates an urgent response. Organizations should prioritize patching all instances of Fluent Bit to version 5.0.8 across their production environments to eliminate the risk of stack-based memory corruption and subsequent exploitation.