CVE-2024-50608 Details
Description
An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the Content-Length) is passed to the function cfl_sds_len, which in turn tries to cast a NULL pointer into struct cfl_sds. This is related to process_payload_metrics_ng() at prom_rw_prot.c.
A denial-of-service vulnerability has been identified in Fluent Bit version 3.1.9, specifically within the Prometheus Remote Write input plugin. When this plugin is active and receiving data, it improperly handles packets with a Content-Length of zero. This oversight leads to a server crash, as the application attempts to dereference a null pointer, causing a segmentation fault. The vulnerability allows remote users with access to the endpoint to disrupt the service.
Users can upgrade to Fluent Bit versions 4.0.2 or 4.0.3, both of which include a patch for this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 19, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://fluentbit.io/announcements/ | [email protected] | Product |
| https://github.com/fluent/fluent-bit/releases | [email protected] | Release Notes |
| https://www.ebryx.com/blogs/exploring-cve-2024-50608-and-cve-2024-50609 | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| treasuredata fluent bit | 3.1.9 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2025 | Initial Analysis | [email protected] |
| Feb 19, 2025 | CVE Modified | CISA-ADP |
| Feb 18, 2025 | New CVE Received | [email protected] |