# Logstash 8.15.1 Security Update (ESA-2024-35)

**URL:** <https://discuss.elastic.co/t/logstash-8-15-1-security-update-esa-2024-35/376920>\
**Category:** Security Announcements\
**Created:** [April 8, 2025, 3:56pm UTC](https://discuss.elastic.co/t/logstash-8-15-1-security-update-esa-2024-35/376920 "2025-04-08T15:56:48Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bryan\_Garcia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bryan_garcia/32/148179_2.png) [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\
**Post date:** [April 8, 2025, 3:56pm UTC](https://discuss.elastic.co/t/logstash-8-15-1-security-update-esa-2024-35/376920/1 "2025-04-08T15:56:48Z")

</div>

**Logstash Uncontrolled Resource Consumption vulnerability (ESA-2024-35)**

On August 19, 2024, Floraison announced CVE-2024-43380, which affects fugit "natural" parser. The parser turns natural language into a cron date and was found to accept any length of input, causing an uncontrolled resource consumption when parsing very long strings.

**Affected Versions:**  
Logstash versions 7.17.0 to 8.15.0.

**Solutions and Mitigations:**  
Users should upgrade to version 8.15.1 or higher.

**Severity:** CVSS v3.1: 5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

**CVE ID:** CVE-2024-43380