# On what version of logstash has fix for issue AIKIDO-2024-10428

**URL:** <https://discuss.elastic.co/t/on-what-version-of-logstash-has-fix-for-issue-aikido-2024-10428/383875>\
**Category:** Logstash\
**Tags:** docker\
**Created:** [December 5, 2025, 6:54am UTC](https://discuss.elastic.co/t/on-what-version-of-logstash-has-fix-for-issue-aikido-2024-10428/383875 "2025-12-05T06:54:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Saikiran\_Pulijala](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saikiran_pulijala/32/134670_2.png) [@Saikiran\_Pulijala](https://discuss.elastic.co/u/Saikiran_Pulijala)\
**Post date:** [December 5, 2025, 6:54am UTC](https://discuss.elastic.co/t/on-what-version-of-logstash-has-fix-for-issue-aikido-2024-10428/383875/1 "2025-12-05T06:54:28Z")

</div>

Hello there,

Our internal container image scanning tool has flagged a vulnerability related to **JRuby’s StringIO library** bundled with **Logstash 8.19.7**.

### **Issue Details**

A vulnerability was reported in **StringIO** , where the methods

- `StringIO#ungetc` and

- `StringIO#ungetbyte`  
may use uninitialized memory, leading to potential memory corruption or unexpected behavior.

Our scan indicates that Logstash 8.19.7 includes **stringio 3.0.8** , while the patched version is **3.1.2 or later**.

### **Request**

Could you please clarify:

1. **Which Logstash version includes JRuby with StringIO ≥ 3.1.2?**

2. **Is there any official documentation listing components or Ruby/JRuby gem versions bundled with each Logstash release?**

3. If a fix is pending, is there an expected timeline or workaround (e.g., manual override, plugin update, custom JRuby upgrade)?

I have not found publicly available information detailing the specific JRuby/StringIO versions packaged with each Logstash build, so guidance would be highly appreciated.

Thanks in advance for your support!

> **[stringio - High Vulnerability - AIKIDO-2024-10428](https://intel.aikido.dev/cve/AIKIDO-2024-10428)**
>
> stringio - High Vulnerability - AIKIDO-2024-10428

Thanks & Regards,

Saikiran

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [December 5, 2025, 12:50pm UTC](https://discuss.elastic.co/t/on-what-version-of-logstash-has-fix-for-issue-aikido-2024-10428/383875/2 "2025-12-05T12:50:11Z")

</div>

As mentioned on the Community Slack, you need to send this to `security@elastic.co` for them to validate if this is impact Logstash or not.

---

<div class="post-metadata">

**Author:** ![Saikiran\_Pulijala](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saikiran_pulijala/32/134670_2.png) [@Saikiran\_Pulijala](https://discuss.elastic.co/u/Saikiran_Pulijala)\
**Post date:** [December 10, 2025, 5:47am UTC](https://discuss.elastic.co/t/on-what-version-of-logstash-has-fix-for-issue-aikido-2024-10428/383875/3 "2025-12-10T05:47:00Z")

</div>

Appreciate your response. I will report at [security@elastic.co](mailto:security@elastic.co). Thanks.