high7.5
CVE-2021-27186
Fluent Bit 1.6.10 has a NULL pointer dereference when an flb_malloc return value is not validated by flb_avro.c or http_server/api/v1/metrics.c.
Impact
Fluent Bit 1.6.10 has a NULL pointer dereference when an flb_malloc return value is not validated by flb_avro.c or http_server/api/v1/metrics.c.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Treasuredata | Fluent Bit | Version 1.6.10 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/fluent/fluent-bit/issues/3044
- https://github.com/fluent/fluent-bit/pull/3045
- https://github.com/fluent/fluent-bit/pull/3047
- https://github.com/fluent/fluent-bit/issues/3044
- https://github.com/fluent/fluent-bit/pull/3045
- https://github.com/fluent/fluent-bit/pull/3047