CVE-2025-37730 Logstash Improper Certificate Validation in TCP output
Attackers can intercept Logstash TCP output traffic via man-in-the-middle attacks when full SSL verification is configured but hostname checks are skipped.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-37730?
CVE-2025-37730 is a medium-severity vulnerability in Elastic Logstash, published on 6 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper certificate validation in Logstash's TCP output could lead to a man-in-the-middle (MitM) attack in “client” mode, as hostname verification in TCP output was not being performed when the ssl_verification_mode => full was set.
Weakness: CWE-295
Which versions are affected by CVE-2025-37730?
1 open source package ship an affected version, including logstash.
| Package | Affected | Fixed in |
|---|---|---|
logstash Bitnami | From 8.0.0 | 8.18.1, 9.0.1 |
How do I fix CVE-2025-37730?
Upgrade logstash to a fixed version for your release line: 8.18.1 or 9.0.1.
Is CVE-2025-37730 being exploited?
There is no known exploitation of CVE-2025-37730 in the wild and no public exploit code.
Sources
Also known as BIT-logstash-2025-37730, GHSA-qrf7-ph5v-mj2v.