{"id":"CVE-2025-29477","aliases":["AZL-59582","AZL-59586","BIT-fluent-bit-2025-29477","EUVD-2025-9768","GHSA-8h3v-hh74-r7p2"],"status":"published","title":"An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the...","description":"An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00185,"percentile":0.08149,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-400"],"published":"2025-04-04T00:00:00Z","modified":"2026-11-05T05:40:51Z","affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"fluent-bit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.6-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"fluent-bit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.10-8"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"fluent-bit","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"products":[{"vendor":"treasuredata","product":"fluent_bit"}],"references":[{"url":"https://github.com/lmarch2/poc/blob/main/fluent-bit/fluent-bit.md","tags":["Exploit","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-29477","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8h3v-hh74-r7p2"}],"sources":{"cve":[{"id":"CVE-2025-29477","description":"An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event.","status":"published","published":"2025-04-04T00:00:00Z","modified":"2025-04-07T18:31:24.907Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:32:45.797843Z"}],"euvd":[{"id":"EUVD-2025-9768","description":"An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event.","status":"published","published":"2025-04-04T00:00:00Z","modified":"2025-04-07T18:31:24Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T20:52:41.16494Z"}],"ghsa":[{"id":"GHSA-8h3v-hh74-r7p2","title":"An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the...","description":"An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event.","status":"published","published":"2025-04-04T18:31:07Z","modified":"2025-04-07T21:32:06Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:00:50.013262Z"}],"nvd":[{"id":"CVE-2025-29477","description":"An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event.","status":"published","published":"2025-04-04T18:15:48.387Z","modified":"2026-06-17T09:05:25.343Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:10:59.48027Z"}],"osv":[{"id":"AZL-59582","title":"CVE-2025-29477 affecting package fluent-bit 3.0.6-6","description":"An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event.","status":"published","published":"2025-04-04T18:15:48Z","modified":"2026-04-21T04:37:18.112574Z","updated_at":"2026-11-02T15:28:07.517393Z"},{"id":"AZL-59586","title":"CVE-2025-29477 affecting package fluent-bit 3.1.10-8","description":"An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event.","status":"published","published":"2025-04-04T18:15:48Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.344052Z"},{"id":"BIT-fluent-bit-2025-29477","description":"An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event.","status":"published","published":"2025-12-09T11:38:37.288Z","modified":"2026-09-08T08:47:17.557466699Z","updated_at":"2026-11-02T15:28:29.563843Z"}]}}