{"id":"CVE-2024-23722","aliases":["AZL-37083","BIT-fluent-bit-2024-23722","EUVD-2024-21183","GHSA-7x4x-j7vx-3p29","UBUNTU-CVE-2024-23722","USN-7250-1"],"status":"published","title":"In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP...","description":"In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It crashes and does not restart. This could result in logs not being delivered properly.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00952,"percentile":0.6156,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-476"],"published":"2024-03-26T00:00:00Z","modified":"2026-10-28T10:40:20Z","exploits":[{"source":"pocgithub","id":"alexcote1/CVE-2024-23722-poc","title":"alexcote1/CVE-2024-23722-poc","date":"2024-03-25","url":"https://github.com/alexcote1/CVE-2024-23722-poc"}],"fixes":[{"ecosystem":"Azure Linux:2","package":"fluent-bit","fixed_in":["2.2.2-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"fluent-bit","fixed_in":["2.2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"fluent-bit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"fluent-bit","ranges":[{"type":"SEMVER","events":[{"introduced":"2.1.8"},{"fixed":"2.2.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"netdata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0+dfsg-1ubuntu0.1~esm1"}]}],"versions":["1.7.0+dfsg-1","1.8.0+dfsg-1","1.9.0+dfsg-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"netdata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.0-3ubuntu1+esm1"}]}],"versions":["1.16.1-2","1.19.0-3ubuntu1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"netdata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33.1-1ubuntu1+esm1"}]}],"versions":["1.29.3-4","1.31.0-4","1.33.1-1ubuntu1"],"bundled":5}],"products":[{"vendor":"fluent","product":"fluent_bit"},{"vendor":"treasuredata","product":"fluent_bit"}],"references":[{"url":"https://github.com/fluent/fluent-bit/compare/v2.2.1...v2.2.2","tags":["x_transferred","Patch","fix","web","report"]},{"url":"https://medium.com/%40adurands82/fluent-bit-dos-vulnerability-cve-2024-23722-4e3e74af9d00","tags":["x_transferred","Exploit","Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23722","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-7x4x-j7vx-3p29"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23722.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-23722","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23722","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7250-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-18836","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18837","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18838","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-22497","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-34250","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-34251","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-23722","description":"In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It crashes and does not restart. This could result in logs not being delivered properly.","status":"published","published":"2024-03-26T00:00:00Z","modified":"2024-08-06T13:47:16.123Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:34:05.444281Z"}],"euvd":[{"id":"EUVD-2024-21183","description":"In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It crashes and does not restart. This could result in logs not being delivered properly.","status":"published","published":"2024-03-26T00:00:00Z","modified":"2024-08-06T13:47:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T01:56:49.310799Z"}],"ghsa":[{"id":"GHSA-7x4x-j7vx-3p29","title":"In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP...","description":"In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It crashes and does not restart. This could result in logs not being delivered properly.","status":"published","published":"2024-03-26T15:30:51Z","modified":"2024-08-06T15:31:52Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:57:52.387174Z"}],"nvd":[{"id":"CVE-2024-23722","description":"In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It crashes and does not restart. This could result in logs not being delivered properly.","status":"published","published":"2024-03-26T15:15:49.317Z","modified":"2026-06-17T07:13:27.383Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:09:43.052376Z"}],"osv":[{"id":"CVE-2024-23722","description":"In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It crashes and does not restart. This could result in logs not being delivered properly.","status":"published","published":"2024-03-26T00:00:00Z","modified":"2026-10-28T10:40:20.53874109Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:38.897406Z"},{"id":"UBUNTU-CVE-2024-23722","description":"In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It crashes and does not restart. This could result in logs not being delivered properly.","status":"withdrawn","published":"2024-03-26T15:15:00Z","modified":"2026-02-28T05:47:52.476519Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"AZL-37083","title":"CVE-2024-23722 affecting package fluent-bit for versions less than 2.2.2-1","description":"In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It crashes and does not restart. This could result in logs not being delivered properly.","status":"published","published":"2024-03-26T15:15:49Z","modified":"2026-04-21T04:28:09.952171Z","updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"BIT-fluent-bit-2024-23722","description":"In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It crashes and does not restart. This could result in logs not being delivered properly.","status":"published","published":"2024-05-29T07:18:00.87Z","modified":"2026-09-08T08:47:10.566826194Z","updated_at":"2026-11-02T15:28:29.563843Z"},{"id":"USN-7250-1","title":"netdata vulnerabilities","description":"It was discovered that Netdata incorrectly handled parsing JSON input,\nwhich could lead to a JSON injection. An attacker could possibly use\nthis issue to execute arbitrary code. This issue only affected \nUbuntu 18.04 LTS. (CVE-2018-18836)\n\nIt was discovered that Netdata incorrectly handled parsing HTTP headers,\nwhich could lead to a HTTP header injection. An attacker could possibly\nuse this issue to cause a denial of service or leak sensitive information.\nThis issue only affected Ubuntu 18.04 LTS. (CVE-2018-18837)\n\nIt was discovered that Netdata incorrectly handled parsing URLs, which\ncould lead to a log injection. An attacker could possibly use this issue\nto consume system resources, resulting in a denial of service. This issue\nonly affected Ubuntu 18.04 LTS. (CVE-2018-18838)\n\nIt was discovered Netdata improperly authenticated API keys. An attacker\ncould possibly use this issue to leak sensitive information or execute\narbitrary code. This issue only affected Ubuntu 20.04 LTS and \nUbuntu 22.04 LTS. (CVE-2023-22497)\n\nIt was discovered Fluent Bit, vendored in Netdata, incorrectly handled\nparsing HTTP payloads. An attacker could possibly use this issue to\ndisrupt logging. This issue only affected Ubuntu 24.10. (CVE-2024-23722)\n\nIt was discovered that WebAssembly Micro Runtime, vendored in Netdata,\nincorrectly handled memory. An attacker could possibly use this issue to\ncause a denial of service. This issue only affected Ubuntu 24.10.\n(CVE-2024-34250, CVE-2024-34251)\n","status":"published","published":"2025-02-03T05:37:36Z","modified":"2026-04-27T17:47:14.71452204Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}