VulnerabilityPublished 4 Sep 2022Updated 21 Oct 2026

Fluent bit: Heap-use-after-free

Affects fluent-bitSource GCVE Database

Severity

Medium

Rated by Threat Radar

Data as of 21 Oct 2026, 20:32 UTC

What to do

Affected software

Product	Affected	Fixed in
OSS-Fuzzfluent-bit`pkg:generic/fluent-bit`Other threats	Affected tiger-2.0.9-dev-20230104 – vv.2.0.7 >=73bc3ec78451aa41757bf7a12366228b79527544 105 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

A heap-use-after-free vulnerability exists in Fluent Bit's mk_event_timeout_destroy function. This flaw involves writing to memory after it has been freed, which can cause undefined behavior or crashes. It affects multiple specific versions from 2.0.0 through 5.1.5, including some development builds. No CVSS score or known exploits are reported.

Impact

Exploitation of this vulnerability can result in undefined behavior such as application crashes or memory corruption in Fluent Bit. No evidence of active exploitation in the wild is known.

Summary

The vulnerability is a heap-use-after-free in the mk_event_timeout_destroy function of Fluent Bit, identified by OSS-Fuzz. This issue allows a write operation on memory that has already been freed, potentially leading to program instability or crashes. The affected versions include a wide range from 2.0.0 up to 5.1.5 and some development versions. There is no CVSS score assigned, and no active exploitation has been reported.

References

bugs.chromium.org/p/oss-fuzz/issues/detail?id=50924 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 21 Oct 2026, 20:32 UTC

Technical details

References

Community reviews

Related threats