CVE-2024-23722
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-23722
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-23722.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-23722
- Aliases
- Downstream
- Published
- 2024-03-26T15:15:49Z
- Modified
- 2025-10-16T19:15:50.563100Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It crashes and does not restart. This could result in logs not being delivered properly.
- References
Affected packages
Git / github.com/fluent/fluent-bit
Database specific
vanir_signatures
[
{
"id": "CVE-2024-23722-27e68006",
"source": "https://github.com/fluent/fluent-bit/commit/eeea396e88da26f586a7cc39df8017ab97f06939",
"signature_type": "Function",
"target": {
"file": "src/flb_upstream.c",
"function": "flb_upstream_get_config_map"
},
"deprecated": false,
"digest": {
"length": 691.0,
"function_hash": "90865790075703438584142393902364139823"
},
"signature_version": "v1"
},
{
"id": "CVE-2024-23722-c0137009",
"source": "https://github.com/fluent/fluent-bit/commit/eeea396e88da26f586a7cc39df8017ab97f06939",
"signature_type": "Line",
"target": {
"file": "src/flb_upstream.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"196706539075106722453368834425070508054",
"62325780143851676895493442942001382677",
"94938995160657019790147823397126362843",
"96065083874535148937582944090435424693",
"117155197622869367373911434048430969643",
"103673809473509712992075559884504640914",
"197625340215341840432280228690740430689"
],
"threshold": 0.9
},
"signature_version": "v1"
}
]