Logstash 8.19.10, 9.1.10, 9.2.4 Security Update (ESA-2026-06)

Sensitive Information in Resource Not Removed Before Reuse in Logstash Leading to Access to Sensitive Information Dependency on Vulnerable Third-Party Component CWE-1395 exists in org.lz4:lz4-java decompression library used by logstash-integration-kafka plugin in Logstash that could allow an...

CLEANSTART-2026-XJ84245 Rack is a modular Ruby web server interface

Multiple security vulnerabilities affect the logstash-fips package. Rack is a modular Ruby web server interface. See references for individual vulnerability details...

CLEANSTART-2026-EW93264 Security fixes for GHSA-4CX2-FC23-5WG6, GHSA-6XW4-3V39-52MM, GHSA-72QJ-48G4-5XGX, GHSA-MR3Q-G2MV-MR4Q, GHSA-P543-XPFM-54CP, GHSA-VC5P-V9HR-52MJ, GHSA-VQG5-3255-V292 applied in versions: 9.0.8-r2, 9.0.8-r3, 9.0.8-r4, 9.3.0-r1, 9.3.0-r2

Multiple security vulnerabilities affect the logstash-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-25500 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, ruby3.4-rails, ruby4.0-rack, ruby4.0-rails, ruby3.2-rails, logstash, ruby3.3-rack, ruby3.3-rails, ruby3.4-rack, ruby3.2-rack...

GHSA-WHRJ-4476-WVMP vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, ruby3.4-rails, ruby4.0-rack, ruby4.0-rails, ruby3.2-rails, logstash, ruby3.3-rack, ruby3.3-rails, ruby3.4-rack, ruby3.2-rack...

CVE-2026-22860 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, ruby3.4-rails, ruby4.0-rack, ruby4.0-rails, ruby3.2-rails, logstash, ruby3.3-rack, ruby3.3-rails, ruby3.4-rack, ruby3.2-rack...

GHSA-MXW3-3HH2-X2MH vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, ruby3.4-rails, ruby4.0-rack, ruby4.0-rails, ruby3.2-rails, logstash, ruby3.3-rack, ruby3.3-rails, ruby3.4-rack, ruby3.2-rack...

CVE-2025-46551 vulnerabilities

Vulnerabilities for packages: elasticsearch, logstash...

GHSA-72QJ-48G4-5XGX vulnerabilities

Vulnerabilities for packages: elasticsearch, logstash...

CVE-2021-22138

In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When specifying a trusted server CA certificate Logstash would not properly verify the certificate returned by the monitoring server. This could result in a man in...

CVE-2022-31520

The Luxas98/logstash-management-api repository through 2020-05-04 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2019-7620

Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin. An unauthenticated user who is able to connect to the port the Logstash beats input could send a specially crafted network packet that would cause Logstash to stop responding...

CVE-2019-7612

A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of the Logstash configuration, the credentials for the URL could be inadvertently logged as part of the error message...

CVE-2025-67735 vulnerabilities

Vulnerabilities for packages: apache-pulsar, logstash-input-http, akhq, apicurio-registry, flyway, apache-nifi-registry, wavefront-proxy, apache-nifi, neo4j, docker-selenium, zipkin, apache-activemq-artemis, thingsboard, wildfly, druid, management-api-for-apache-cassandra-5.0, kserve-modelmesh,...

GHSA-84H7-RJJ3-6JX4 vulnerabilities

Vulnerabilities for packages: apache-pulsar, logstash-input-http, akhq, apicurio-registry, flyway, apache-nifi-registry, wavefront-proxy, apache-nifi, neo4j, docker-selenium, zipkin, apache-activemq-artemis, thingsboard, wildfly, druid, management-api-for-apache-cassandra-5.0, kserve-modelmesh,...

CVE-2025-67735 vulnerabilities

Vulnerabilities for packages: apache-hop, management-api-for-apache-cassandra-5.0, apache-activemq-artemis, flyway, knative-kafka-broker-fips, spark, zipkin, elasticsearch, strimzi-kafka-operator, trino, management-api-for-apache-cassandra-4.1, hadoop-fips, elasticsearch-fips, tez, thingsboard,...

GHSA-84H7-RJJ3-6JX4 vulnerabilities

Vulnerabilities for packages: apache-hop, management-api-for-apache-cassandra-5.0, apache-activemq-artemis, flyway, knative-kafka-broker-fips, spark, zipkin, elasticsearch, strimzi-kafka-operator, trino, management-api-for-apache-cassandra-4.1, hadoop-fips, elasticsearch-fips, tez, thingsboard,...

CVE-2025-34274

Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the root user. If an attacker is able to compromise the Logstash process - for example by exploiting an insecure plugin, pipeline configuration...

EUVD-2025-37221

Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the root user. If an attacker is able to compromise the Logstash process - for example by exploiting an insecure plugin, pipeline configuration...

CVE-2025-34274

Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the root user. If an attacker is able to compromise the Logstash process - for example by exploiting an insecure plugin, pipeline configuration...