LiveActive security incident?Get immediate response
CVE Record

CVE-2021-36088: Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb_free (called from flb_parser_json_...

Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb_free (called from flb_parser_json_do and flb_parser_do).

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

Fluent Bit 1.7.0 through 1.7.4 contains a double-free memory bug in JSON parsing. The CVSS score is critical because the record rates it as network-reachable with no authentication or user interaction required, with high confidentiality, integrity, and availability impact.

Executive priority

Treat as urgent if Fluent Bit 1.7.0-1.7.4 is in production logging paths. Prioritize inventory and upgrade verification. Do not claim breach or active exploitation from these sources alone.

Technical view

CVE-2021-36088 is a CWE-415 double free in flb_free reached from flb_parser_json_do and flb_parser_do. The public record identifies Fluent Bit 1.7.0 through 1.7.4 as affected and references OSS-Fuzz, OSV, an upstream commit, and pull request for context.

Likely exposure

Exposure is limited to environments running Fluent Bit 1.7.0 through 1.7.4, especially where untrusted or externally influenced JSON log input reaches the parser. The source bundle does not identify affected CPEs or downstream packaged products.

Exploitation context

The provided sources do not show CISA KEV listing or confirmed active exploitation. Risk is still material because the CVSS vector is network, low complexity, no privileges, and no user interaction. The issue originated from OSS-Fuzz reporting.

Researcher notes

The record is sparse: no affected CPEs, no exploit confirmation, and no explicit fixed version in the supplied bundle. Analysis should anchor on the version range, CWE-415, parser call path, CVSS vector, OSS-Fuzz/OSV references, and upstream fix artifacts.

Mitigation direction

  • Inventory Fluent Bit versions across hosts, containers, and logging images.
  • Move off Fluent Bit 1.7.0 through 1.7.4.
  • Review the referenced upstream commit and pull request for fixed-code lineage.
  • Check Fluent Bit or package vendor guidance for the exact safe release.
  • Limit exposure of log ingestion paths to trusted sources where feasible.

Validation and detection

  • Confirm deployed fluent-bit binaries or container tags are not 1.7.0 through 1.7.4.
  • Check SBOMs and base images for embedded Fluent Bit packages.
  • Review logging pipelines where JSON input reaches Fluent Bit parsers.
  • Verify upgrade evidence against vendor release notes or the referenced fix commit.
  • Monitor Fluent Bit crash patterns until affected versions are retired.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-415: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-36088 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2021-36088Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

CWE-415

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-415 · source CWE mapping

Double Free

Double Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs