Medium severity5.7NVD Advisory· Published Oct 10, 2025· Updated Jun 17, 2026
CVE-2025-37727
CVE-2025-37727
Description
Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
15cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*range: >=7.0.0,<=7.17.29
- (no CPE)range: 7.0.0
- osv-coords13 versionspkg:apk/chainguard/conductorpkg:apk/chainguard/conductor-fipspkg:apk/chainguard/elasticsearch-fips-8.17pkg:apk/chainguard/elasticsearch-fips-8.17-bitnamipkg:apk/chainguard/elasticsearch-fips-8.18-bitnamipkg:apk/chainguard/ruby3.2-elasticsearchpkg:apk/chainguard/ruby3.3-elasticsearchpkg:apk/chainguard/ruby3.4-elasticsearchpkg:apk/wolfi/ruby3.2-elasticsearchpkg:apk/wolfi/ruby3.3-elasticsearchpkg:apk/wolfi/ruby3.4-elasticsearchpkg:bitnami/elasticsearchpkg:maven/org.elasticsearch/elasticsearch
< 3.31.0-r4+ 12 more
- (no CPE)range: < 3.31.0-r4
- (no CPE)range: < 3.31.0-r4
- (no CPE)range: < 8.17.10-r14
- (no CPE)range: < 8.17.10-r14
- (no CPE)range: < 8.18.8-r5
- (no CPE)range: < 9.2.0-r0
- (no CPE)range: < 9.2.0-r0
- (no CPE)range: < 9.2.0-r0
- (no CPE)range: < 9.2.0-r0
- (no CPE)range: < 9.2.0-r0
- (no CPE)range: < 9.2.0-r0
- (no CPE)range: < 8.18.8
- (no CPE)range: >= 7.0.0, < 8.18.8
Patches
Vulnerability mechanics
References
6- discuss.elastic.co/t/elasticsearch-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-18/382453nvdVendor Advisory
- github.com/advisories/GHSA-56r7-h6mw-rcfvghsaADVISORY
- github.com/elastic/elasticsearch/commit/0b876b816544ff5ed07fc9d67cc584b58241e116ghsa
- github.com/elastic/elasticsearch/commit/e982eef416a5e1c2a4e94236d7d3b33b5c8d07dbghsa
- nvd.nist.gov/vuln/detail/CVE-2025-37727ghsa
- www.elastic.co/guide/en/elasticsearch/reference/8.18/release-notes-8.18.8.htmlghsa
News mentions
0No linked articles in our index yet.