Elastic Logstash vulnerabilities

CVEs per yearBy the year they were published

1. 20172
2. 20181
3. 20193
4. 20231
5. 20251
6. 20261

Newest CVEs

• CVE-2026-33466

  Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write

  Elastic · Logstash

  High8.1
• CVE-2025-37730

  Logstash Improper Certificate Validation in TCP output

  Elastic · Logstash

  Medium6.5
• CVE-2023-46672

  Logstash Insertion of Sensitive Information into Log File

  Elastic · Logstash

  High8.4
• CVE-2019-7620

  Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin. An unauthenticated user who is able to connect to…

  Elastic · Logstash

  High7.5
• CVE-2019-7613

  Winlogbeat versions before 5.6.16 and 6.6.2 had an insufficient logging flaw. An attacker able to inject certain characters into a log entry could prevent…

  Elastic · Logstash

  High7.5
• CVE-2019-7612

  A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of…

  Elastic · Logstash

  Critical9.8
• CVE-2018-3817

  When logging warnings regarding deprecated settings, Logstash before 5.6.6 and 6.x before 6.1.2 could inadvertently log sensitive information.

  Elastic · Logstash

  Medium6.5
• CVE-2016-10363

  Logstash versions prior to 2.3.3, when using the Netflow Codec plugin, a remote attacker crafting malicious Netflow v5, Netflow v9 or IPFIX packets could…

  Elastic · Logstash

  High7.5
• CVE-2016-10362

  Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials.

  Elastic · Logstash

  Medium6.5