Filebeat package (filebeat-9.2.1-amd64.deb) is affected by CVE-2025-11226/CVE-2025-5818/CVE-2025-47914

Elastic Stack Beats
1

Hi, I see the filebeat-9.2.1-amd64.deb is affected by CVE-2025-10543 which is present on GitHub - eclipse-paho/paho.mqtt.golang 1.3.5 and fixed on 1.5.1. Also, the same package is affected by CVE-2025-58181 and CVE-2025-47914 which relates to The Go Programming Language 0.41.0 fixed on 0.45.0. I understand these dependencies are not developed by Elastic but as the filebeat is using them, is there any plans to update the filebeat package regarding these CVEs?

Thank you in advance,

Cesar Lino

1 Like
2

You need to check if the last version, 9.2.4, has fixed those CVEs.

If those are still present on the last version you need to contact security@elastic.co with the CVE list so they can validate.

1 Like