camunda-zeebe-8.7
Chainguard
Status
Impact
Upstream maintainers need to address CVE-2024-52980, as the substantial code changes between Elasticsearch versions 7.17.28 and 8.15.1, combined with Camunda Zeebe's direct use of Elasticsearch internals, have caused build failures during attempted upgrades.
Status
Impact
Remediation requires upgrading the Elasticsearch Java client from 8.13.4 to 8.15+, which introduces breaking API changes (RangeQuery.Builder.field() method removal) that require substantial code changes. The fix exists in https://github.com/camunda/camunda/pull/29167 but contains branching functional changes and fails to build when applied to 8.7.6. Upstream maintainers will need to release a new minor version with the Elasticsearch client compatibility fixes to remediate this issue.
Status