CVE-2021-22133

Information Disclosure in go.elastic.co/apm

2.4 LowFix available

The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it is possible the headers will not be sanitized before being sent.

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.53%Up 0.1 points since Apr 14, 2021

What each source reports

NVD Score used 2.4

Record: CVE-2021-22133
CVSS 3.1: 2.4 LowCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0: 2.7 LowAV:A/AC:L/Au:S/C:P/I:N/A:N
Weakness: CWE-532
Updated: 2026-11-02

CVE List No score

Record: CVE-2021-22133
Weakness: CWE-532
Updated: 2026-11-02

EUVDEUVD-2021-1171 No score

Record: EUVD-2021-1171
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qqc5-rgcc-cjqh 2.4

Information Disclosure in go.elastic.co/apm

Record: GHSA-qqc5-rgcc-cjqh
CVSS 3.1: 2.4 LowCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-532
Updated: 2026-11-02

OSVGHSA-qqc5-rgcc-cjqh 2.4

Information Disclosure in go.elastic.co/apm

Record: GHSA-qqc5-rgcc-cjqh
CVSS 3.1: 2.4 LowCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-532
Updated: 2026-11-02

OSVGO-2022-0706 No score

Information disclosure in go.elastic.co/apm

Sensitive HTTP headers may not be properly sanitized before being sent to the APM server if the program panics.

Record: GO-2022-0706
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`go.elastic.co/apm` Go	before 1.11.0	1.11.0

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-22133 is a low vulnerability (CVSS 2.4) in Elastic Apm Agent, published February 10, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 44th percentile. Fixed in go.elastic.co/apm 1.11.0.