logstash-9.0-with-output-opensearch

Direct Vulnerabilities

Known vulnerabilities in the logstash-9.0-with-output-opensearch package. This does not include vulnerabilities belonging to this package’s dependencies.

Vulnerability	Vulnerable Version
H CVE-2026-13506	*
C CVE-2026-8763	*
L Allocation of Resources Without Limits or Throttling	*
C Improper Check for Unusual or Exceptional Conditions	*
H Algorithmic Complexity	*
L Interpretation Conflict	*
L Uncontrolled Recursion	*
L Improper Certificate Validation	*
L Uncontrolled Memory Allocation	*
L Improper Input Validation	*
L Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')	*
L Improper Input Validation	*
L Information Exposure Through Caching	*
L Improper Encoding or Escaping of Output	*
M Use After Free	*
L NULL Pointer Dereference	*
L Heap-based Buffer Overflow	*
L Resource Exhaustion	*
M CRLF Injection	*
L Resource Exhaustion	*
H HTTP Request Smuggling	*
H Allocation of Resources Without Limits or Throttling	*
L Improper Access Control	*
H Resource Exhaustion	*
H Loop with Unreachable Exit Condition ('Infinite Loop')	*
L Improperly Controlled Modification of Dynamically-Determined Object Attributes	*
L GHSA-r7wm-3cxj-wff9	*
L CVE-2025-14813	*
L Improperly Controlled Modification of Dynamically-Determined Object Attributes	*
L Incomplete Blacklist	*
L Server-Side Request Forgery (SSRF)	*
L Incomplete Blacklist	*
L GHSA-wjv4-x9w8-wm3h	*
H Loop with Unreachable Exit Condition ('Infinite Loop')	*
L Uncontrolled Recursion	*
L GHSA-wfpw-mmfh-qq69	*
L GHSA-5v8h-3h3q-446p	*
L GHSA-5prr-v3j2-97mh	*
L CVE-2026-54905	*
L GHSA-p67v-3w7g-wjg7	*
L GHSA-8678-w3jw-xfc2	*
L Missing Lock Check	*
L GHSA-phwj-rprq-35pp	*
L GHSA-9cv2-cfxc-v4v2	*
L HTTP Request Smuggling	*
L Improper Verification of Cryptographic Signature	*
L Improper Neutralization	*
L Arbitrary Command Injection	*
L Arbitrary Command Injection	*
L Resource Exhaustion	*
L Authentication Bypass	*
L Allocation of Resources Without Limits or Throttling	*
L Improper Access Control	*
M Server-Side Request Forgery (SSRF)	*
L CVE-2025-12183	*
L Information Exposure	*
L GHSA-v2fc-qm4h-8hqv	*
L GHSA-c4rq-3m3g-8wgx	*
L Integer Overflow or Wraparound	<9.0.8-r8
C HTTP Request Smuggling	<9.0.8-r8
C HTTP Request Smuggling	<9.0.8-r8
L Resource Exhaustion	<9.0.8-r8
L Cross-site Scripting (XSS)	<9.0.8-r8
L Improper Encoding or Escaping of Output	<9.0.8-r8
M Link Following	<9.0.8-r8
H Loop with Unreachable Exit Condition ('Infinite Loop')	<9.0.8-r8
H NULL Pointer Dereference	<9.0.8-r8
M Out-of-bounds Write	<9.0.8-r8
H HTTP Request Smuggling	<9.0.8-r8
L CVE-2026-39825	<9.0.8-r8
L CVE-2026-42499	<9.0.8-r8
H Allocation of Resources Without Limits or Throttling	<9.0.8-r8
H Double Free	<9.0.8-r8
L Resource Exhaustion	<9.0.8-r8
L CVE-2026-42501	<9.0.8-r8
C Arbitrary Command Injection	*
H Algorithmic Complexity	*
M Arbitrary Command Injection	*
L CRLF Injection	<9.0.8-r8
H Missing Report of Error Condition	*
M Allocation of Resources Without Limits or Throttling	*
H Resource Exhaustion	*
L Inefficient Regular Expression Complexity	*
L Incorrect Behavior Order: Validate Before Canonicalize	*
L Resource Exhaustion	*
M Interpretation Conflict	*
H Permissive Regular Expression	*
H Resource Exhaustion	*
L Partial Comparison	*
M Improper Validation of Syntactic Correctness of Input	*
M Interpretation Conflict	*
C Improper Authentication	*
L Resource Exhaustion	*
L Permissive Regular Expression	*
M Improper Handling of Length Parameter Inconsistency	*
H Improper Encoding or Escaping of Output	*
L CVE-2026-5588	*
L CVE-2026-0636	*
M Improper Validation of Certificate with Host Mismatch	*
L Race Condition	*
H Improper Encoding or Escaping of Output	*
L CVE-2026-5598	*
L Protection Mechanism Failure	*
L Information Exposure Through Server Log Files	*
H Access of Resource Using Incompatible Type ('Type Confusion')	<9.0.8-r7
C CVE-2026-27143	<9.0.8-r7
H Allocation of Resources Without Limits or Throttling	<9.0.8-r7
H Incorrect Authorization	<9.0.8-r7
L HTTP Request Smuggling	<9.0.8-r7
L CVE-2026-32280	<9.0.8-r7
M Cross-site Scripting (XSS)	<9.0.8-r7
H Improper Certificate Validation	<9.0.8-r7
H Improper Certificate Validation	<9.0.8-r7
M Allocation of Resources Without Limits or Throttling	<9.0.8-r7
M Link Following	<9.0.8-r7
L GHSA-72hv-8253-57qq	*
L Cross-site Scripting (XSS)	<9.0.8-r6
L Directory Traversal	<9.0.8-r6
L Direct Request ('Forced Browsing')	<9.0.8-r6
L GHSA-wx95-c6cv-8532	*
L Cross-site Scripting (XSS)	*
L Directory Traversal	*
L Server-Side Request Forgery (SSRF)	*
C CVE-2025-68121	<9.0.8-r5
L CVE-2025-61732	<9.0.8-r5
L Allocation of Resources Without Limits or Throttling	<9.0.8-r3
L Out-of-bounds Write	<9.0.8-r3
L CVE-2025-61730	<9.0.8-r3
L CVE-2025-61731	<9.0.8-r3
L Allocation of Resources Without Limits or Throttling	<9.0.8-r3
H Information Exposure	*
M Improper Certificate Validation	*
L CRLF Injection	<9.0.8-r3
L CVE-2025-14762	*
L Improper Certificate Validation	<9.0.8-r2
L Improper Certificate Validation	<9.0.8-r2
L Algorithmic Complexity	<9.0.8-r1
L Allocation of Resources Without Limits or Throttling	<9.0.8-r1
L CVE-2025-58186	<9.0.8-r1
L Allocation of Resources Without Limits or Throttling	<9.0.8-r1
L Information Exposure Through Log Files	<9.0.8-r1
L CVE-2025-58183	<9.0.8-r1
L Improper Certificate Validation	<9.0.8-r1
L Allocation of Resources Without Limits or Throttling	<9.0.8-r1
L CVE-2025-47912	<9.0.8-r1
L CVE-2025-61725	<9.0.8-r1
L Resource Exhaustion	*
L Resource Exhaustion	*
H Inefficient Regular Expression Complexity	*
L Resource Exhaustion	*
M Information Exposure	*
L Resource Exhaustion	*
L CVE-2025-8916	*
M Improper Cross-boundary Removal of Sensitive Data	*
H Improper Handling of Highly Compressed Data (Data Amplification)	<9.0.7-r0
L Improper Certificate Validation	*
M Resource Exhaustion	*
H Inefficient Regular Expression Complexity	*
H Allocation of Resources Without Limits or Throttling	*

logstash-9.0-with-output-opensearch

Direct Vulnerabilities

Fix vulnerabilities automatically