CVE-2016-10363
HighSummary
Logstash versions prior to 2.3.3, when using the Netflow Codec plugin, are vulnerable to denial of service attacks. A remote attacker can exploit crafted Netflow v5, Netflow v9, or IPFIX packets, causing the Logstash process to crash.
Risk Assessment
An attacker could cause the Logstash service to become unavailable, impacting data processing within the organization. This may lead to disruptions in applications relying on Logstash.
Recommendation
It is recommended to upgrade Logstash to version 2.3.3 or later to mitigate the risk associated with this vulnerability. Additionally, monitoring network traffic for potential attacks is advisable.
Other vulnerabilities in Logstash
See all- CVE-2015-5378High
Logstash versions 1.5.x before 1.5.3 and 1.4.x before 1.4.4 allow remote attackers to read communications between Logstash Forwarder agent and Logstash server.
- CVE-2016-1000222High
Logstash versions prior to 2.1.2 are vulnerable to attacks via engineered input that can create malicious formulas in CSV data.
- CVE-2026-33466High
Logstash contains a path traversal vulnerability (CWE-22) in archive extraction utilities. An attacker can supply a crafted archive, allowing arbitrary file write with Logstash process privileges. In configurations with automatic pipeline reloading, this can lead to remote code execution.
Original NVD description (English source)
Logstash versions prior to 2.3.3, when using the Netflow Codec plugin, a remote attacker crafting malicious Netflow v5, Netflow v9 or IPFIX packets could perform a denial of service attack on the Logstash instance. The errors resulting from these crafted inputs are not handled by the codec and can cause the Logstash process to exit.