Package
logstash-9.5
Component
concurrent-ruby
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
concurrent-ruby at 1.1.9 is vulnerable, fixed in 1.3.7. The gem is a transitive dependency of logstash-core, whose gemspec constrains it to "> 1", "< 1.1.10"; no newer version resolves at build time, and 1.1.9 is the newest release the constraint permits. multi_json is pinned to "> 1.19.1" as a consequence of the same constraint, so the two are coupled. Awaiting a released Logstash whose logstash-core permits concurrent-ruby 1.3.7 or later.
Upstream reference: https://github.com/elastic/logstash/issues/13956
Status