Please get in touch with the team at fluentbit-security@googlegroups.com, and we'll take it from there.
Thank you in advance for helping to keep Fluent-bit secure.

For related CVEs that may or not affect Fluent Bit we'll be doing the corresponding announcement through discussions.