Medium severity5.7NVD Advisory· Published Aug 3, 2024· Updated Jun 17, 2026
CVE-2024-37286
CVE-2024-37286
Description
APM server logs contain document body from a partially failed bulk index request. For example, in case of unavailable_shards_exception for a specific document, since the ES response line contains the document body, and that APM server logs the ES response line on error, the document is effectively logged.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/elastic/apm-serverGo | < 8.14.0 | 8.14.0 |
Affected products
6cpe:2.3:a:elastic:apm_server:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:elastic:apm_server:*:*:*:*:*:*:*:*range: <8.14.0
- (no CPE)range: 8.14.0
- osv-coords4 versionspkg:apk/chainguard/apm-serverpkg:apk/chainguard/apm-server-compatpkg:apk/chainguard/apm-server-fipspkg:golang/github.com/elastic/apm-server
< 0+ 3 more
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 8.14.0
Patches
Vulnerability mechanics
References
4- discuss.elastic.co/t/apm-server-8-14-0-security-update-esa-2024-19/364289nvdVendor AdvisoryWEB
- github.com/advisories/GHSA-f6cj-4h3g-hwq4ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-37286ghsaADVISORY
- pkg.go.dev/vuln/GO-2024-3037ghsaWEB
News mentions
0No linked articles in our index yet.