{"id":27206,"date":"2026-09-22T04:30:42","date_gmt":"2026-09-21T20:30:42","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-61674"},"modified":"2026-09-22T04:30:42","modified_gmt":"2026-09-21T20:30:42","slug":"cve-2026-61674","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-61674","title":{"rendered":"CVE-2026-61674 &#8211; Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Linux, BSD, m"},"content":{"rendered":"<p>Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Linux, BSD, macOS, and Windows. From 0.11.0 until 5.0.8, plugins\/out_forward\/forward.c secure_forward_pong copies the server-controlled PONG[2] reason into the 32-byte stack buffer msg with memcpy without checking its MessagePack type or length. An attacker who controls or can impersonate an out_forward Secure Forward destination configured with Shared_Key or Empty_Shared_Key can send an oversized reason during the first handshake and overwrite stack control data. Protected builds reliably terminate, while builds without a stack canary or with a disclosure can allow remote code execution as the Fluent Bit process user. When the opt-in &#8211;supervisor mode is used, fork-only respawns preserve the canary and address layout, allowing repeated crash-or-survive probes to support code execution on a hardened build; ordinary exec-based or service-manager restarts do not preserve that state. This issue is fixed in version 5.0.8.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Linux, BSD, macOS, and Windows. From 0.11.0 until 5.0.8, plugins\/out_forward\/forward.c secure_forward_pong copies the serve<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-27206","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/27206","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=27206"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=27206"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=27206"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}