CVE-2021-22143

Elastic APM .NET Agent information disclosure

2.1 LowFix available

The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application error it is possible the headers will not be sanitized before being sent.

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: Low
Privileges needed: High
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.66%Up 0.6 points since Nov 22, 2023

What each source reports

CVE List Score used 2.1

Elastic APM .NET Agent information disclosure

Record: CVE-2021-22143
CVSS 3.1: 2.1 LowCVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

EUVDEUVD-2023-2978 2.1

Record: EUVD-2023-2978
CVSS 3.1: 2.1 LowCVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-hx93-gc73-5rpr 2.1

Exposure of Sensitive Information in Elastic APM .NET Agent

Record: GHSA-hx93-gc73-5rpr
CVSS 3.1: 2.1 LowCVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
Weakness: CWE-200, CWE-532
Updated: 2026-11-02

NVD 2.1

Record: CVE-2021-22143
CVSS 3.1: 2.1 LowCVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200, CWE-532
Updated: 2026-11-02

OSV 4.3

Record: CVE-2021-22143
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSVGHSA-hx93-gc73-5rpr 2.1

Exposure of Sensitive Information in Elastic APM .NET Agent

Record: GHSA-hx93-gc73-5rpr
CVSS 3.1: 2.1 LowCVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
Weakness: CWE-200, CWE-532
Updated: 2026-11-02

Affected products

elastic apm .net agent

Affected packages

Affected packages
Package	Affected	Fixed
`Elastic.Apm` NuGet	before 1.10.0	1.10.0
`Elastic.Apm` NuGet	before 1.10.0, plus listed versions 0.0.10.0.1-alpha0.0.2-alpha1.0.01.0.0-beta1 Show 17 moreShow less 1.0.11.1.01.1.11.1.21.2.01.3.01.3.11.4.01.5.01.5.11.6.01.6.11.7.01.7.11.8.01.8.11.9.0	1.10.0

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-22143 is a low vulnerability (CVSS 2.1) in Elastic Apm .net Agent, published November 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 51st percentile. Fixed in Elastic.Apm 1.10.0.