CVE-2019-9749 - CVE House
Back to Database
Status published High CVE-2019-9749

An issue was discovered in the MQTT input plugin in...

Vulnerability Description

An issue was discovered in the MQTT input plugin in Fluent Bit through 1.0.4. When this plugin acts as an MQTT broker (server), it mishandles incoming network messages. After processing a crafted packet, the plugin's mqtt_packet_drop function (in /plugins/in_mqtt/mqtt_prot.c) executes the memmove() function with a negative size parameter. That leads to a crash of the whole Fluent Bit server via a SIGSEGV signal.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-9749

Credits & Attribution

No credits recorded in the NVD database.

References

More from treasuredata

View All →
CVE-2021-46879
An issue was discovered in Treasure Data Fluent Bit 1.7.1,...
Unknown 0
CVE-2021-46878
An issue was discovered in Treasure Data Fluent Bit 1.7.1,...
Unknown 0
CVE-2021-36088
Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double...
Unknown 0
CVE-2021-27186
Fluent Bit 1.6.10 has a NULL pointer dereference when an...
High 7.5
CVE-2020-35963
flb_gzip_compress in flb_gzip.c in Fluent Bit before 1.6.4 has an...
High 7.8

Affected Vendor

treasuredata

View all reports →

Affected Software

fluent bit
Vulnerable Versions:
0

Timeline

Official Publish: March 13th, 2019
Last Modified: September 16th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.