CVE-2024-23722: Treasuredata Fluent Bit

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It crashes and does not restart. This could result in logs not being delivered properly.

Affected products

• Treasuredata Fluent Bit: from 2.1.8, before 2.2.2 (fixed in 2.2.2)

Published 2024-03-26. Last modified 2026-06-17.