CVE-2024-50608

An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the Content-Length) is passed to the function cfl_sds_len, which in turn tries to cast a NULL pointer into struct cfl_sds. This is related to process_payload_metrics_ng() at prom_rw_prot.c.

• CWE-476

• https://fluentbit.io/announcements/Product
• https://github.com/fluent/fluent-bit/releasesRelease Notes
• https://www.ebryx.com/blogs/exploring-cve-2024-50608-and-cve-2024-50609Exploit, Third Party Advisory

Published

Feb 18, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-50599A reflected Cross-Site Scripting (XSS) vulnerability has bee…6.1
• CVE-2024-5060The LottieFiles – JSON Based Animation Lottie & Bodymovin fo…5.4
• CVE-2024-50600An issue was discovered in Samsung Mobile Processor and Wear…7.5
• CVE-2024-50601Persistent and reflected XSS vulnerabilities in the themeMod…6.1
• CVE-2024-50602An issue was discovered in libexpat before 2.6.4. There is a…5.9
• CVE-2024-50603An issue was discovered in Aviatrix Controller before 7.1.41…9.8
• CVE-2024-50609An issue was discovered in Fluent Bit 3.1.9. When the OpenTe…7.5
• CVE-2024-5061The Enfold - Responsive Multi-Purpose Theme theme for WordPr…5.4
• CVE-2024-50610GSL (GNU Scientific Library) through 2.8 has an integer sign…3.6
• CVE-2024-50611CycloneDX cdxgen through 10.10.7, when run against an untrus…7.2
• CVE-2024-50612libsndfile through 1.2.2 has an ogg_vorbis.c vorbis_analysis…5.5
• CVE-2024-50613libsndfile through 1.2.2 has a reachable assertion, that may…6.5