Fluent Bit

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $5,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month, not for the report. This project sits at Tier 2, the OSS-Fuzz row, where the panel grades a merged patch from $100 for a one-liner up to $5,000 for a complicated, high-impact improvement, entirely at its discretion. The $15,000 headline and the 2× and 3× memory-safety multipliers are Tier 1 only and are not reachable here. Patches must be at least one month and no more than twelve months old, submissions are capped at three per person per month, and sanctions and territory exclusions apply. CVE history 5 Last 12 months 18 Lifetime Memory safety 55 % Denial of service 20 % Parsing/validation 15 % Info disclosure 5 % Latest advisories Loading the feed Overview Fluent Bit is the default log forwarder in Amazon EKS, in Google Kubernetes Engine's logging agent, in Azure Kubernetes Service's Container Insights and in the default logging DaemonSet of a very large share of self-managed clusters, with a second life embedded in appliances, edge devices and telco NFV stacks. Its security position is close to worst-case: a C program running as a privileged DaemonSet on every node, parsing log files written by every workload on that node, holding the output credentials for the central logging backend. A memory-safety bug reachable from a log line gives any tenant code execution on the node. The SECURITY.md carries no reward language, only a 72-hour acknowledgement commitment, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The project takes reports at [email protected] and through GitHub advisory reporting, and commits to acknowledging within 72 hours. What is covered is github.com/fluent/fluent-bit in full, with nothing narrower carved out The C core: the event loop, the memory and chunk management layer, the scheduler and the configuration parser Every input plugin the project ships rather than only the ones with a CVE, tail , forward , http , syslog , tcp and opentelemetry among them The whole filter set, including the Kubernetes metadata filter that enriches records with cluster state The parsers as a family: regex, JSON, LTSV, logfmt and the multiline engine, which is what OSS-Fuzz actually targets Every output plugin and its serialisation path, together with the TLS layer that carries records to the central backend and the credentials it holds MessagePack encoding and decoding, Fluent Bit's internal record format, through which every record passes whichever plugin produced it The HTTP monitoring and hot-reload interfaces the daemon exposes to an operator Out of scope Fluentd ( fluent/fluentd ), which has no OSS-Fuzz integration and therefore no patch pathway at all, and whose own policy separately carves out in_debug_agent eval, record_transformer with enable_ruby , and ReDoS on Ruby 3.2 and below The Chronosphere and Calyptia commercial distributions, which are vendor products rather than this repository Defects that live in a vendored third-party library rather than in Fluent Bit's own code, since coverage follows the repository and every project is a separate OSS-Fuzz entry One-line fixes for non-exploitable crashes and resource-exhaustion denial of service, which the Patch Rewards rules exclude by name and which describe most of this project's fuzzing output Patches outside the one-to-twelve-month age window the rules impose Most-valued findings Memory corruption in a parser reachable from an ordinary log line, which on a privileged node DaemonSet means any tenant that can write a log gets code execution on the node. Memory safety is 55% of the CVE history and this is the shape that matters A structural hardening of one of the parsers, regex, JSON, LTSV, logfmt or multiline, that closes a whole class of malformed-input handling. Those are the highest-value memory-safety surfaces here, and it is what the reward panel will actually pay for given it refuses one-liner crash fixes Memory-safety defects in MessagePack encode and decode, a recurring CVE source, since every record inside Fluent Bit passes through that format regardless of which plugin produced it Input-plugin flaws in forward , http , syslog or tcp reachable from an unauthenticated network peer rather than from a local file, which widens the attacker set from tenants to anyone routable Anything that exposes or exfiltrates the output credentials Fluent Bit holds for the central logging backend, which is the one secret this process carries Findings demonstrated against the default DaemonSet configuration that EKS, GKE or AKS ship, rather than one the reporter had to weaken first Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report to [email protected] or through GitHub advisory reporting; the project acknowledges within 72 hours and pays nothing for the report itself Send a detailed, reproducible report with the log line, record or packet that triggers it; if we can't reproduce it, it isn't eligible Fluentd is not covered on the patch pathway at all. There is no fluentd OSS-Fuzz project, and conflating the two invents a pathway that does not exist If you also want the Google patch money, land the fix upstream yourself and keep it merged without reverts for a month; that is a separate pathway with its own rules The one-liner exclusion bites hardest here: a very large share of Fluent Bit's OSS-Fuzz output is single-input parser crashes, and a qualifying patch generally has to harden a parser structurally rather than add a bounds check on one path Patch Rewards is capped at three submissions per person per month, takes patches between one and twelve months old, is discretionary and cancellable, and excludes researchers on sanctions lists or located in Russia or Belarus Disclosure Coordinated with the Fluent Bit security team, which commits to acknowledging a report within 72 hours and publishes GitHub Security Advisories with researcher credit; hold the detail until the advisory is out. On the patch pathway the fix is public the moment it merges, so Google's rules carry no confidentiality term at all. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability