CVE-2025-12970

Published Nov 24, 2025

Last updated 7 days ago

Fluent Bit

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-12970 is a stack buffer overflow vulnerability found in the Docker Metrics input plugin (in\_docker) of Fluent Bit. The vulnerability occurs because the `extract_name` function copies container names into a fixed-size stack buffer without validating the length of the container name. The buffer size is 256 bytes. An attacker who can create containers or control container names can exploit this vulnerability by supplying an excessively long container name. This can lead to a buffer overflow, potentially causing a process crash or arbitrary code execution on the host running Fluent Bit.

Description: The extract_name function in Fluent Bit in_docker input plugin copies container names into a fixed size stack buffer without validating length. An attacker who can create containers or control container names, can supply a long name that overflows the buffer, leading to process crash or arbitrary code execution.
Source: cret@cert.org
NVD status: Modified
Products: fluent_bit

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-120

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:treasuredata:fluent_bit:4.1.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4D0EA105-B741-4E44-828A-9300B09A7A79"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.