Medium severity6.5NVD Advisory· Published Apr 7, 2025· Updated Jun 17, 2026
CVE-2025-30373
CVE-2025-30373
Description
Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP response (401) is returned, the message will be ingested nonetheless. To mitigate the vulnerability, disable http-based inputs and allow only authenticated pull-based inputs. This vulnerability is fixed in 6.1.9.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.graylog2:graylog2-serverMaven | >= 6.1.0, < 6.1.9 | 6.1.9 |
Affected products
2- Range: >= 6.1.0, < 6.1.9
Patches
Vulnerability mechanics
References
4- github.com/Graylog2/graylog2-server/commit/31bc13d3cd6f550ec83473d0f8666cd3ebf50f10nvdPatchWEB
- github.com/Graylog2/graylog2-server/security/advisories/GHSA-q7g5-jq6p-6wvxnvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-q7g5-jq6p-6wvxghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-30373ghsaADVISORY
News mentions
0No linked articles in our index yet.