Fluentbit release 4.0.14 missing?

[chrisbra]

Hi,
as of https://fluentbit.io/blog/2025/10/28/security-vulnerabilities-addressed-in-fluent-bit-v4.1-and-backported-to-v4.0/ I am looking to install fluent-bit 4.0.14. However there is neither an announcement for v4.0.14 nor a tag for that version available. Latest current version for v4.0 as of today still seems to be 4.0.13 but apparently that does not fix the reported issues?

So will there be a backport for v4.0 release or not? Am I missing something? Thanks for clarification.

[patrick-stephens]

You are correct @chrisbra, the blog post references a non-existent release. I'm checking it this is just a typo - I think it should be 4.0.13

[chrisbra]

Thanks for checking. BTW: that blog post would hugely benefit from linking the actual CVEs and not just some Common Weakness Enumerations, which are not unique for the issues described

[patrick-stephens]

Confirmed with @celalettin1286 and @lecaros it should be 4.0.13. I'm not sure where the blogs are hosted now to make the update so will leave it with them to sort.

[eschabell]

@patrick-stephens I can update that blog post, stand-by...

[patrick-stephens]

Thanks @eschabell, can you close this once done?

I do agree as well with @chrisbra comments that we should link the actual CVEs and ideally also make the Github advisory public with relevant information for patched versions.

[cfi-gb]

Hello *,

this is based on a discussion started in https://www.openwall.com/lists/oss-security/2025/12/01/6:

Is 4.0.13 really the correct fix for these flaws? If we check https://kb.cert.org/vuls/id/761751 (They seems to took over coordination) it seems to mention 4.0.12 as a relevant fix so there is yet another different fix floating around.

And if we check https://github.com/fluent/fluent-bit/releases version 4.0.13 only contains two changelog entries shared with version 4.1.1. Furthermore 4.0.12 was released more closely to 4.1.1 then 4.0.13 and 4.2.0.

It would be great to get some final confirmation that 4.0.13 is really the fixed version (previously only "should" was mentioned).

[patrick-stephens]

I would raise this via the security mailing list rather than adding it to a closed issue as no one will see that: https://github.com/fluent/fluent-bit/security/policy

Email: fluentbit-security@googlegroups.com

[cfi-gb]

Thanks a lot for the reference, i was already aware of it but had (maybe wrongly) assumed that this issue is still monitored via notifications by involved people and also assumed that it could be maybe re-opened / it should be easily for a project to track the fixed status of vulnerabilities in the own product.

I will forward the question to the mailing list instead 👍

[cfi-gb]

Note / disclaimer: I have forwarded this assessment to the security team but still want to post it here to have it publicly available / accessible (which isn't the case when doing mail conversations).

Sorry for the short follow-up but i noticed that https://fluentbit.io/blog/2025/10/28/security-vulnerabilities-addressed-in-fluent-bit-v4.1-and-backported-to-v4.0/ includes links to the related / relevant PRs:

• in_http: fix handling of URL encoded value #10961
• in_http: in_splunk: in_elasticsearch: fix tag_key lookup #10967
• out_file: sanitize incoming Tag to prevent path traversal #10969
• in_docker: add helper for container name parsing #10972
• in_forward: Fix user authentication to align Fluentd's behavior #10973

and if we check / follow these we can see each backport to the 4.0.x branch:

• in_http: fix handling of URL encoded value [Backport to 4.0] #10982
• in_http: in_splunk: in_elasticsearch: fix tag_key lookup [Backport to 4.0] #10991
• out_file: sanitize incoming Tag to prevent path traversal [Backport to 4.0] #10983
• in_docker: add helper for container name parsing [Backport to 4.0] #10984
• in_forward: Fix user authentication to align Fluentd's behavior [Backport to 4.0] #10986

If finally checking https://github.com/fluent/fluent-bit/releases/tag/v4.0.12 we can see that these PRs are actually included in 4.0.12 and not in 4.0.13.

Only for the last issue (CWE 306 - Missing authentication in in_forward) mentioned on the blog post follow-up fixes have been made via these for 4.2.0:

• in_forward: fix username parsing #11026
• in_forward: Fix incorrect user auth sequence #11028

which ended up via this PR in 4.0.13:

• in_forward: Fix of handshaking on forward protocol [Backport to 4.0] #11029

My initial assumption is that four out of the five issues / CVEs are actually already fixed in 4.0.12 while one requires 4.0.13 for a "full" fix and 4.1.1 is currently still partly affected by that one.

[cosmo0920]

My initial assumption is that four out of the five issues / CVEs are actually already fixed in 4.0.12 while one requires 4.0.13 for a "full" fix and 4.1.1 is currently still partly affected by that one.

Yes, the former part is correct. We'd fixed the last missing piece in 4.0.13 and in 4.1 branch.
But we didn't release the plugged version for 4.1 series. It should be released as 4.1.2.