we are running Elasticsearch-8.17.10 on 6 RHEL 8 servers. But we are getting vulnerability Apache Tika 1.13 < 3.2.2 XXE (CVE-2025-66516) and Apache Log4j 2.0-beta9 < 2.25.3 MitM in VA scan report of server. log4j vulnerability is not getting fixed by upgrading elasticsearch to version 8.19.10.How to fix these vulnerabilities?
Hello, I’m also facing the same issue as you. I’ve upgraded to version 8.19.11, but the security vulnerability is still present. Have you managed to resolve this problem yet? If so, please share how you fixed it with me.