CVE-2024-50608

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://fluentbit.io/announcements/", "name": "https://fluentbit.io/announcements/", "tags": ["Product"], "refsource": ""}, {"url": "https://github.com/fluent/fluent-bit/releases", "name": "https://github.com/fluent/fluent-bit/releases", "tags": ["Release Notes"], "refsource": ""}, {"url": "https://www.ebryx.com/blogs/exploring-cve-2024-50608-and-cve-2024-50609", "name": "https://www.ebryx.com/blogs/exploring-cve-2024-50608-and-cve-2024-50609", "tags": ["Exploit", "Third Party Advisory"], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the Content-Length) is passed to the function cfl_sds_len, which in turn tries to cast a NULL pointer into struct cfl_sds. This is related to process_payload_metrics_ng() at prom_rw_prot.c."}]}, "problemtype": {"problemtype_data": [{"description": []}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2024-50608", "ASSIGNER": "cve@mitre.org"}}, "impact": {}, "publishedDate": "2025-02-18T18:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:treasuredata:fluent_bit:3.1.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2025-04-22T14:54Z"}