Potential impact of Apache Log4j issue #4255 on Elastic products

Elastic Stack Elasticsearch
1

Hello,

A new Apache Log4j security issue was reported on August 24, 2026:

There is also a public PoC/reproduction here:

According to the report, the issue affects Log4j's handling of serialized LogEvent objects and may allow a java.rmi.MarshalledObject to bypass the protection provided by FilteredObjectInputStream, potentially resulting in unsafe Java deserialization and RCE when a suitable gadget chain is available.

The reporter currently lists Log4j API 2.11.0 through 2.26.1 and Log4j Core 2.8.0 through 2.26.1 as affected. However, exploitation appears to require a specific application architecture where attacker-controlled serialized Log4j events can reach the vulnerable deserialization path, so simply using an affected Log4j version does not necessarily imply exploitability.

Could Elastic confirm whether any currently supported Elastic products or components are affected by this issue?

In particular:

  • Do Elasticsearch, Logstash, or other Elastic Stack components expose or use the affected serialized LogEvent deserialization path?

  • Is FilteredObjectInputStream / serialized Log4j event handling reachable from any network-facing functionality in supported Elastic configurations?

  • If affected Log4j versions are bundled but the vulnerable code path is not reachable, can Elastic confirm that these products are not exploitable through this issue?

  • Is Elastic currently tracking this issue and planning a security advisory or dependency update if required?

There does not appear to be an upstream fixed Log4j release for #4255 yet, so an assessment from Elastic regarding actual product exposure would be useful.

Thanks.

Willem

2

Thank you for your report.

Elastic's security reporting guidelines are available at Product Security at Elastic | Elastic.

Per those guidelines, all reports of potential security issues or vulnerabilities should be sent via email to security@elastic.co.

We are unable to discuss potential issues of this nature here. Please send your report to the email address above, where it can be appropriately handled.

4

Sent the email, feel free to delete this post.