This vulnerability occurs when Fluent Bit’s out_forward Secure Forward PONG handler copies a server‐controlled PONG[2] reason into a 32‑byte stack buffer using memcpy without validating the MessagePack type or length. An attacker who controls or can impersonate a Secure Forward destination configured with Shared_Key or Empty_Shared_Key can send an oversized reason during the first handshake, overwriting stack control data and potentially executing arbitrary code as the Fluent Bit process user or causing a denial of service.

Fluent Bit vendors and releases from 0.11.0 through 5.0.8 inclusive are affected on all supported operating systems. The issue resides in plugins/out_forward/forward.c and is triggered only when Secure Forward destinations use the Shared_Key or Empty_Shared_Key options. Version 5.0.8 and newer contain a fix that validates the length prior to copying.

The CVSS score of 9.2 reflects critical severity. The EPSS score is not available, so a precise exploitation probability is unknown, but the absence of stack canaries or the presence of disclosures could enable successful attacks. The vulnerability is not listed in the CISA KEV catalog, and no public exploits have been reported. Attackers can exploit the flaw remotely by sending an oversized PONG reason from an impersonated or compromised Secure Forward destination; the exposed network interface and the vulnerability’s ability to overwrite stack frames give this vulnerability a high operational risk when the affected configuration is in use.