# Inquiry schedule: Backport concurrent-ruby 1.3.7 to Logstash 8.19.x for CVE-2026-54904(High) **URL:** \ **Category:** Logstash\ **Tags:** docker\ **Created:** [August 24, 2026, 10:10am UTC](https://discuss.elastic.co/t/inquiry-schedule-backport-concurrent-ruby-1-3-7-to-logstash-8-19-x-for-cve-2026-54904-high/389887 "2026-08-24T10:10:26Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Della](https://avatars.discourse-cdn.com/v4/letter/d/c68b51/32.png) [@Della](https://discuss.elastic.co/u/Della)\ **Post date:** [August 24, 2026, 10:10am UTC](https://discuss.elastic.co/t/inquiry-schedule-backport-concurrent-ruby-1-3-7-to-logstash-8-19-x-for-cve-2026-54904-high/389887/1 "2026-08-24T10:10:26Z")
Dear Elastic Security & Logstash Team, We are running Logstash 8.19.19 in production environment. Security scanning (Docker Scout/Trivy) detects high vulnerability CVE-2026-54904 in embedded concurrent-ruby gem 1.1.9. The officially fixed version of concurrent-ruby is 1.3.7. We need official confirmation for compliance audit: 1. Will Elastic backport this dependency upgrade to Logstash 8.19 long-term support branch? 2. If scheduled, please provide exact target Logstash 8.19 minor version and approximate release date. Current temporary mitigation: We rebuild Docker images with manual gem upgrade via ‘logstash-plugin install concurrent-ruby --version 1.3.7’. But our security policy prefers official pre-built release rather than manual modification. Waiting for your reply. We would greatly appreciate your timely reply. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 24, 2026, 4:12pm UTC](https://discuss.elastic.co/t/inquiry-schedule-backport-concurrent-ruby-1-3-7-to-logstash-8-19-x-for-cve-2026-54904-high/389887/2 "2026-08-24T16:12:13Z")
You [should address this](https://www.elastic.co/product-security) to [security@elastic.co](mailto:security@elastic.co)