LO
Product
Logstash
13
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 5Medium 3Low 1
Watch
Add Logstash to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-33466 | 9.8 | Apr 8 | Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write Affected: 8.0.0 through 8.19.13 |
| CVE-2019-7612 | 9.8 | Mar 25 | A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs Affected: before 5.6.15; 6.0.0 before 6.6.1 |
| CVE-2019-7620 | 7.5 | Oct 30 | Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin Affected: 6.0.0 before 6.8.4; 7.0.0 before 7.4.1 |
| CVE-2015-5378 | 7.5 | Jun 27 | Logstash 1.5.x before 1.5.3 and 1.4.x before 1.4.4 allows remote attackers to read communications between Logstash Forwarder agent and Logstash server Affected: 1.4.0; 1.4.1; 1.4.2 |
| CVE-2016-10363 | 7.5 | Jun 16 | Logstash versions prior to 2.3.3, when using the Netflow Codec plugin, a remote attacker crafting malicious Netflow v5, Netflow v9 or IPFIX packets could perform a denial of… Affected: through 2.3.2 |
| CVE-2016-1000222 | 7.5 | Jun 16 | Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data Affected: through 2.1.1 |
| CVE-2016-1000221 | 7.5 | Jun 16 | Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information Affected: through 2.3.3 |
| CVE-2018-3817 | 6.5 | Mar 30 | When logging warnings regarding deprecated settings, Logstash before 5.6.6 and 6.x before 6.1.2 could inadvertently log sensitive information Affected: before 5.6.6; 6.0.0 before 6.1.2 |
| CVE-2015-5619 | 5.9 | Aug 9 | Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack output or the Logstash forwarder does not validate SSL/TLS certificates from the Logstash server, which might… Affected: 1.4.0; 1.4.1; 1.4.2 |
| CVE-2023-46672 | 5.5 | Nov 15 | An issue was identified by Elastic whereby sensitive information is recorded in Logstash logs under specific circumstances Affected: 8.10.0 before 8.11.1; 7.12.1 |
| CVE-2021-22138 | 3.7 | May 13 | In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature Affected: 6.4.0 before 6.8.15; 7.0.0 before 7.12.0 |
| CVE-2015-4152 | – | Jun 15 | Directory traversal vulnerability in the file output plugin in Elasticsearch Logstash before 1.4.3 allows remote attackers to write to arbitrary files via vectors related to… Affected: through 1.4.2 |
| CVE-2014-4326 | – | Jul 22 | Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) zabbix.rb or (2) nagios_nsca.rb in… Affected: 1.0.14; 1.0.15; 1.0.16; 1.0.17; 1.1.0; 1.1.0.1; +21 more |
Showing 13