products / logstash

Logstash

Logstash is Elastic's log ingestion and routing pipeline. It processes every log event in the stack and often holds credentials to multiple upstream and downstream data sources. NVD tracks it as elastic:logstash with dotted stack versions. Pairs with Elasticsearch and Kibana coverage.

api usage

Querying Logstash

product sluglogstash
version format7.13.0, 8.11.1
bash
curl "https://api.attestd.io/v1/check?product=logstash&version=7.13.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Logstash 7.13.0 is affected by CVE-2021-22132 (information disclosure via Logstash monitoring APIs). The aggregated response expects risk_state: "elevated".

json
{
  "product": "logstash",
  "version": "7.13.0",
  "supported": true,
  "risk_state": "elevated",
  "risk_factors": [
    "information_disclosure",
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": "7.13.4",
  "confidence": 0.84,
  "cve_ids": ["CVE-2021-22132"],
  "last_updated": "2026-05-27T00:00:00Z"
}
safe version

Logstash 8.15.0 is used as a patched-line example; confirm with live /v1/check after ingestion.

bash
curl "https://api.attestd.io/v1/check?product=logstash&version=8.15.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"
notable cves

CVE history

Logstash CVE history includes information disclosure in monitoring APIs, denial of service via crafted pipeline configurations, and deserialization issues in input plugins.

CVEDescriptionAffectsCVSS
CVE-2023-31141Denial of service via crafted Logstash pipeline configuration causing unbounded memory consumption.8.8.0 to 8.8.27.5
CVE-2021-22132Information disclosure via Logstash monitoring and pipeline APIs exposing sensitive event data.7.13.0 to 7.13.36.5
CVE-2021-22135Information disclosure in Logstash JDBC input plugin via error message handling.7.11.0 to 7.12.15.3
CVE-2020-7017Cross-site scripting in Logstash monitoring API responses.before 7.6.26.1
related