Fluent Bit
Logging · products/fluent-bit.yaml · RSS
Latest 5.1.5 Oct 21, 2026
Lifecycle
| Branch | Latest | Released | End of life |
|---|---|---|---|
| 5.1 | 5.1.5 | Aug 6, 2026 | — · maintained |
| 5.0 | 5.0.11 | Mar 31, 2026 | Nov 6, 2026 · maintained |
| 4.2 | 4.2.8 | Nov 11, 2025 | Jun 30, 2026 · ended |
| 4.1 | 4.1.2 | Sep 24, 2025 | Feb 11, 2026 · ended |
| 4.0 | 4.0.14 | Mar 29, 2025 | Dec 24, 2025 · ended |
| 3.2 | 3.2.10 | Nov 12, 2024 | Jun 29, 2025 · ended |
| 3.1 | 3.1.10 | Jul 8, 2024 | Feb 12, 2025 · ended |
| 3.0 | 3.0.7 | Mar 21, 2024 | Oct 8, 2024 · ended |
| 2.2 | 2.2.3 | Nov 6, 2023 | Jun 21, 2024 · ended |
| 2.1 | 2.1.10 | Apr 18, 2023 | Feb 6, 2024 · ended |
| 2.0 | 2.0.14 | Oct 25, 2022 | Jul 19, 2023 · ended |
| 1.9 | 1.9.10 | Mar 11, 2022 | Dec 5, 2022 · ended |
| 1.8 | 1.8.15 | Jul 7, 2021 | Dec 5, 2022 · ended |
| 1.7 | 1.7.9 | Feb 14, 2021 | — · ended |
| 1.6 | 1.6.10 | Oct 8, 2020 | — · ended |
| 1.5 | 1.5.6 | Jul 13, 2020 | — · ended |
| 1.4 | 1.4.6 | Mar 25, 2020 | — · ended |
| 1.3 | 1.3.11 | Sep 30, 2019 | — · ended |
| 1.2 | 1.2.2 | Jun 26, 2019 | — · ended |
| 1.1 | 1.1.3 | May 8, 2019 | — · ended |
| 1.0 | 1.0.6 | Dec 13, 2018 | — · ended |
| 0.14 | 0.14.9 | Aug 29, 2018 | — · ended |
| 0.13 | 0.13.8 | Apr 30, 2018 | — · ended |
| 0.12 | 0.12.19 | Aug 17, 2017 | — · ended |
| 0.11 | 0.11.17 | Mar 30, 2017 | — · ended |
| 0.10 | 0.10.1 | Dec 30, 2016 | — · ended |
Recent releases
securitysecurity: harden input handling across core, http_server and plugins
securitysecurity: harden network input handling (part 2)
securitysecurity: harden record processing in core, filters and outputs
breakingCODEOWNERS: remove @braydonk and @jefferbrecht
securitysecurity: update policy for 5.0 and EOL 4.1
breakingout_logdna: remove promoted known keys
Security advisories
6.5 CVE-2025-12969 Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditions. This allows remote attackers with network access to…
8.8 CVE-2025-12970 The extract_name function in Fluent Bit in_docker input plugin copies container names into a fixed size stack buffer without validating length. An attacker who can create containers or control cont…
5.3 CVE-2025-12972 Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This…
9.1 CVE-2025-12977 Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the ability to write records into Splunk or Elasticsearch can s…
5.4 CVE-2025-12978 Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a…
5.5 CVE-2025-29478 An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the cfl_list_size in cfl_list.h:165.
5.5 CVE-2025-29477 An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event.
7.5 CVE-2024-50608 An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it cr…
7.5 CVE-2024-50609 An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the…
9.8 CVE-2024-4323 A memory corruption vulnerability in Fluent Bit versions 2.0.7 thru 3.0.3. This issue lies in the embedded http server’s parsing of trace requests and may result in denial of service conditions, in…
7.5 CVE-2024-23722 In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It crashes and does not restart. This could r…
7.5 CVE-2024-26455 fluent-bit 2.2.2 contains a Use-After-Free vulnerability in /fluent-bit/plugins/custom_calyptia/calyptia.c.
7.8 CVE-2021-46878 An issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in flb_pack_msgpack_to_json_format leads to type confusion bug that interprets whatever is on the stack as msgpack maps…
7.8 CVE-2021-46879 An issue was discovered in Treasure Data Fluent Bit 1.7.1, a wrong variable is used to get the msgpack data resulting in a heap overflow in flb_msgpack_gelf_value_ext. An attacker can craft a malic…
9.8 CVE-2021-36088 Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb_free (called from flb_parser_json_do and flb_parser_do).
7.5 CVE-2021-27186 Fluent Bit 1.6.10 has a NULL pointer dereference when an flb_malloc return value is not validated by flb_avro.c or http_server/api/v1/metrics.c.
7.8 CVE-2020-35963 flb_gzip_compress in flb_gzip.c in Fluent Bit before 1.6.4 has an out-of-bounds write because it does not use the correct calculation of the maximum gzip data-size expansion.
7.5 CVE-2019-9749 An issue was discovered in the MQTT input plugin in Fluent Bit through 1.0.4. When this plugin acts as an MQTT broker (server), it mishandles incoming network messages. After processing a crafted p…