{"document":{"category":"csaf_vex","csaf_version":"2.0","distribution":{"text":"Copyright © Red Hat, Inc. All rights reserved.","tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en","notes":[{"category":"legal_disclaimer","text":"This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.","title":"Terms of Use"}],"publisher":{"category":"vendor","contact_details":"https://access.redhat.com/security/team/contact/","issuing_authority":"Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.","name":"Red Hat Product Security","namespace":"https://www.redhat.com"},"references":[{"category":"self","summary":"Canonical URL","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-61674.json"}],"title":"fluent-bit: Fluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handler","tracking":{"current_release_date":"2026-10-16T11:18:21+00:00","generator":{"date":"2026-10-16T11:18:21+00:00","engine":{"name":"Red Hat SDEngine","version":"5.4.2"}},"id":"CVE-2026-61674","initial_release_date":"2026-09-21T16:10:15.276000+00:00","revision_history":[{"date":"2026-09-21T16:10:15.276000+00:00","number":"1","summary":"Initial version"},{"date":"2026-10-16T10:15:45+00:00","number":"2","summary":"Current version"},{"date":"2026-10-16T11:18:21+00:00","number":"3","summary":"Last generated version"}],"status":"final","version":"3"}},"product_tree":{"branches":[{"category":"vendor","name":"Red Hat","product":{"name":"All currently supported Red Hat products","product_id":"red_hat_products","product_identification_helper":{"cpe":"cpe:/a:redhat"}}}]},"vulnerabilities":[{"cve":"CVE-2026-61674","discovery_date":"2026-09-22T15:57:18.480452+00:00","flags":[{"label":"vulnerable_code_not_present","product_ids":["red_hat_products"]}],"notes":[{"category":"description","text":"A flaw was found in Fluent Bit. A stack-based buffer overflow exists in the forward output plugin due to insufficient bounds checking on server responses during connection handshakes. A remote attacker controlling or impersonating a destination server can exploit this vulnerability by sending an oversized response, potentially leading to arbitrary code execution or a Denial of Service (DoS).","title":"Vulnerability description"},{"category":"other","text":"A critical vulnerability was found in Fluent Bit, which is shipped in Red Hat's community-supported Fedora and EPEL fluent-bit packages. During the out_forward plugin's Secure Forward handshake, the secure_forward_pong handler copies the server-supplied PONG reason string into a fixed 32-byte stack buffer using memcpy without validating its MessagePack type or length. A remote attacker who controls or can impersonate (be on-path to) an out_forward Secure Forward destination configured with Shared_Key or Empty_Shared_Key can send an oversized reason during the first handshake and overwrite stack control data. On builds with stack protections this causes reliable termination of the Fluent Bit process (remote denial of service); on builds without a stack canary, or where the canary is disclosed, it permits remote code execution as the Fluent Bit process user. When the opt-in --supervisor mode is used, fork-only respawns preserve the stack canary and address-space layout, allowing repeated crash-or-survive probes that can support code execution even on hardened builds; ordinary exec-based or service-manager restarts re-randomize that state. Within the Red Hat portfolio, only the community-supported Fedora and EPEL fluent-bit packages are in scope; no Red Hat-managed product is affected, and a fix is being pursued through the community maintainers under a delegated resolution. Red Hat's CVSS v3.1 score of 8.1 reflects the high attack complexity of requiring control or impersonation of the forward destination, whereas the upstream CVEORG record scores this flaw 9.2 (critical) under CVSS v4.0.","title":"Statement"},{"category":"general","text":"The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.","title":"CVSS score applicability"}],"product_status":{"known_not_affected":["red_hat_products"]},"references":[{"category":"self","summary":"Canonical URL","url":"https://access.redhat.com/security/cve/CVE-2026-61674"},{"category":"external","summary":"https://www.cve.org/CVERecord?id=CVE-2026-61674","url":"https://www.cve.org/CVERecord?id=CVE-2026-61674"},{"category":"external","summary":"https://nvd.nist.gov/vuln/detail/CVE-2026-61674","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61674"},{"category":"external","summary":"https://github.com/fluent/fluent-bit/commit/45486556be9d023e194665e243f156b228e195e0","url":"https://github.com/fluent/fluent-bit/commit/45486556be9d023e194665e243f156b228e195e0"},{"category":"external","summary":"https://github.com/fluent/fluent-bit/pull/11945","url":"https://github.com/fluent/fluent-bit/pull/11945"},{"category":"external","summary":"https://github.com/fluent/fluent-bit/releases/tag/v5.0.8","url":"https://github.com/fluent/fluent-bit/releases/tag/v5.0.8"},{"category":"external","summary":"https://github.com/fluent/fluent-bit/security/advisories/GHSA-jrp8-r9hx-gf73","url":"https://github.com/fluent/fluent-bit/security/advisories/GHSA-jrp8-r9hx-gf73"}],"release_date":"2026-09-21T16:10:15.276000+00:00","scores":[{"cvss_v3":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["red_hat_products"]}],"title":"fluent-bit: Fluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handler"}]}