CVE-2025-12978: fluent bit (CVSS 5.4)

Description

Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote attacker with authenticated or exposed access to these input endpoints can exploit this behavior to manipulate tags and redirect records to unintended destinations. This compromises the authenticity of ingested logs and can allow injection of forged data, alert flooding and routing manipulation.

Is your site exposed to CVE-2025-12978?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Affected Products

Vendor	Product	Versions
treasuredata	fluent_bit	All

References

Other References

https://fluentbit.io/announcements/v4.1.0/

Frequently Asked Questions

What is CVE-2025-12978? +

Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote attacker with authenticated or exposed access to these input endpoints can exploit this behavior to manipulate tags and redirect records to unintended destinations. This compromises the authenticity of ingested logs and can allow injection of forged data, alert flooding and routing manipulation. It has a CVSS v3.1 base score of 5.4 (MEDIUM).

How severe is CVE-2025-12978? +

CVE-2025-12978 has a CVSS v3.1 score of 5.4 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-12978? +

CVE-2025-12978 affects products from treasuredata, specifically: fluent_bit. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-12978? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-4323 9.8

A memory corruption vulnerability in Fluent Bit versions 2.0.7 thru 3.0.3. This issue lies in the embedded http server’s parsing …

CVE-2025-12977 9.1

Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the …

CVE-2025-12970 8.8

The extract_name function in Fluent Bit in_docker input plugin copies container names into a fixed size stack buffer without validating …

CVE-2024-50608 7.5

An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on …

CVE-2024-23722 7.5

In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the …

CVE-2024-50609 7.5

An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP …

CVE-2025-12978