Inquiry schedule: Backport concurrent-ruby 1.3.7 to Logstash 8.19.x for CVE-2026-54904(High)

Elastic Stack Logstash
1

Dear Elastic Security & Logstash Team,

We are running Logstash 8.19.19 in production environment. Security scanning (Docker Scout/Trivy) detects high vulnerability CVE-2026-54904 in embedded concurrent-ruby gem 1.1.9. The officially fixed version of concurrent-ruby is 1.3.7.

We need official confirmation for compliance audit:

  1. Will Elastic backport this dependency upgrade to Logstash 8.19 long-term support branch?
  2. If scheduled, please provide exact target Logstash 8.19 minor version and approximate release date.
    Current temporary mitigation: We rebuild Docker images with manual gem upgrade via ‘logstash-plugin install concurrent-ruby --version 1.3.7’. But our security policy prefers official pre-built release rather than manual modification.

Waiting for your reply. We would greatly appreciate your timely reply.

2

You should address this to security@elastic.co