Package
elasticsearch-fips-9.4
Component
log4j-api
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
CVE-2026-49844 (GHSA-qv9r-c865-cp47) affects Apache Log4j (org.apache.logging.log4j:log4j-api), fixed in 2.25.5 and 2.26.1. In elasticsearch 9.4, the affected log4j-api (2.25.4) is bundled (shaded) inside the Elastic APM Java agent (elastic-apm-agent-java8), which vendors its own copy of log4j and does not expose it as an independently replaceable dependency. Remediation requires an upstream Elastic APM Java agent release that bundles log4j-api >= 2.25.5 (or >= 2.26.1). As of this writing the latest APM Java agent release (1.56.0) still bundles a vulnerable log4j (2.26.0), so no available agent upgrade resolves the finding. This advisory will be updated when a fixed APM agent release is available. References: NVD CVE-2026-49844; Apache Log4j security advisory GHSA-qv9r-c865-cp47.
Status
Previous location
/usr/share/elasticsearch/modules/apm/elastic-apm-agent-java8-1.55.6.jarNew location
/usr/share/elasticsearch/modules/apm/elastic-apm-agent-java8-1.56.0.jarImpact
version-only path change detected during APK rebuild
Status