CVE-2025-37730

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-37730
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-37730.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-37730
Aliases
Published
2025-05-06T17:29:07Z
Modified
2026-08-12T03:51:13Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Logstash Improper Certificate Validation in TCP output
Details

Improper certificate validation in Logstash's TCP output could lead to a man-in-the-middle (MitM) attack in “client” mode, as hostname verification in TCP output was not being performed when the ssl_verification_mode => full was set.

Database specific 
{
    "cna_assigner": "elastic",
    "cwe_ids": [
        "CWE-295"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37730.json"
}
References

Affected packages

Git / github.com/elastic/logstash

Affected ranges

Type
GIT
Repo
https://github.com/elastic/logstash
Events
Introduced
737f0617b0f41a50b735f2e59fd6dca67519c414
Fixed
03939becb3a1a37debf605569aebea0dff9bb2f3
Introduced
9e3be9602a620af998d9bfdbbb632e06ad082c82
Fixed
4f9dfc74ddac310aefb1db8f0766cf47127de3d4
Introduced
f15ae9fbb067e491795deeed285d44c784f997da
Fixed
4e850d791be668438b0d19f729fa734d4bc7657b
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.17.6"
        },
        {
            "introduced": "8.18.0"
        },
        {
            "fixed": "8.18.1"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.0.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v8.*
v8.18.0
v9.*
v9.0.0
v9.0.0-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-37730.json"