CVE-2020-35963

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

flb_gzip_compress in flb_gzip.c in Fluent Bit before 1.6.4 has an out-of-bounds write because it does not use the correct calculation of the maximum gzip data-size expansion.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27261Exploit, Issue Tracking, Third Party Advisory
https://fluentbit.io/announcements/v1.6.4/Release Notes, Vendor Advisory
https://github.com/fluent/fluent-bit/commit/cadff53c093210404aed01c4cf586adb8caa07afPatch, Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27261Exploit, Issue Tracking, Third Party Advisory
https://fluentbit.io/announcements/v1.6.4/Release Notes, Vendor Advisory
https://github.com/fluent/fluent-bit/commit/cadff53c093210404aed01c4cf586adb8caa07afPatch, Third Party Advisory

Timeline

Published: Jan 3, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-359646.5track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing.CVE-2020-359657.5decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero CVE-2020-35975.4A vulnerability in the configuration restore feature of Cisco Nexus Data Broker software could allow an unauthenticated, remote attacker to CVE-2020-359707.5An issue was discovered in YzmCMS 5.8. There is a SSRF vulnerability in the background collection management that allows arbitrary file read CVE-2020-359715.4A storage XSS vulnerability is found in YzmCMS v5.8, which can be used by attackers to inject JS code and attack malicious XSS on the /admin CVE-2020-359724.3An issue was discovered in YzmCMS V5.8. There is a CSRF vulnerability that can add member user accounts via member/member/add.html.CVE-2020-359735.4An issue was discovered in zzcms2020. There is a XSS vulnerability that can insert and execute JS code arbitrarily via /user/manage.php.CVE-2020-359797.8An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is heap-based buffer overflow in the function gp_rtp_builder_do_avc() in ietf CVE-2020-35986.5A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attack CVE-2020-359807.8An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is a use-after-free in the function gf_isom_box_del() in isomedia/box_funcs.c CVE-2020-359817.8An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is an invalid pointer dereference in the function SetupWriters() in isomedia/CVE-2020-359827.8An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is an invalid pointer dereference in the function gf_hinter_track_finalize()