Loading vulnerability…
Stack buffer overflow in Fluent Bit Docker Metrics input
CVE-2025-12970 is a stack-based buffer overflow in the extract_name() function of Fluent Bit's Docker Metrics input plugin (in_docker). The function copies container names into a fixed 256-byte stack buffer without validating their length. An attacker able to create containers or control names processed by the plugin can supply an excessively long name, causing memory corruption that can crash Fluent Bit or potentially execute arbitrary code. Only configurations using the Docker input plugin are affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disrupt telemetry collection and forwarding by crashing the Fluent Bit process. Arbitrary code execution could compromise the agent's confidentiality and integrity, allowing access to telemetry, credentials, and other resources available to its runtime identity. The extent of host or infrastructure compromise depends on the agent's privileges and accessible resources.
If you can’t patch tonight, do this now.
Until patched, disable the Docker Metrics input plugin where operationally feasible. Restrict container creation and renaming privileges to trusted identities, and enforce container-name length validation before names reach Fluent Bit. Run Fluent Bit without root privileges and restrict its filesystem and credential access to reduce the consequences of successful code execution.
Patch, then assume compromise.
Upgrade Fluent Bit to version 4.2.0 or a later supported release containing the fix. Rebuild and redeploy source-compiled installations and affected container images as applicable, ensuring running agents use the patched Docker input plugin.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.