{"id":"CVE-2021-22133","aliases":["EUVD-2021-1171","GHSA-qqc5-rgcc-cjqh","GO-2022-0706"],"status":"published","title":"Information Disclosure in go.elastic.co/apm","description":"The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it is possible the headers will not be sanitized before being sent.","severity":{"version":"3.1","score":2.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00528,"percentile":0.45025,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2021-02-10T18:55:15Z","modified":"2026-06-17T03:36:40Z","fixes":[{"ecosystem":"Go","package":"go.elastic.co/apm","fixed_in":["1.11.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"go.elastic.co/apm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0"}]}]},{"source":"osv","ecosystem":"Go","package":"go.elastic.co/apm","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.0"}]}]},{"source":"osv","ecosystem":"Go","package":"go.elastic.co/apm","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.0"}]}]}],"products":[{"vendor":"elastic","product":"apm_agent"},{"vendor":"elastic","product":"elastic apm agent for go"}],"references":[{"url":"https://discuss.elastic.co/t/elastic-apm-agent-for-go-1-11-0-security-update/263252","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22133","tags":["advisory"]},{"url":"https://github.com/elastic/apm-agent-go/commit/c5c7e21aa26a6def7790f74fbceed792ad47ef35","tags":["web"]},{"url":"https://github.com/elastic/apm-agent-go/compare/v1.10.0...v1.11.0","tags":["web"]},{"url":"https://github.com/elastic/apm-agent-go/pull/888","tags":["web","fix"]},{"url":"https://github.com/elastic/apm-agent-go/commit/dd3e8c593580e7b80a98b57e1cc6e017e56747b4","tags":["web","fix"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0706","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qqc5-rgcc-cjqh"},{"url":"https://github.com/elastic/apm-agent-go","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-22133","description":"The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it is possible the headers will not be sanitized before being sent.","status":"published","published":"2021-02-10T18:55:15Z","modified":"2024-08-03T18:30:24.014Z","cwes":["CWE-532"],"updated_at":"2026-11-02T14:32:57.701381Z"}],"euvd":[{"id":"EUVD-2021-1171","description":"The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it is possible the headers will not be sanitized before being sent.","status":"published","published":"2021-02-10T18:55:15Z","modified":"2024-08-03T18:30:24Z","updated_at":"2026-11-03T03:25:03.638882Z"}],"ghsa":[{"id":"GHSA-qqc5-rgcc-cjqh","title":"Information Disclosure in go.elastic.co/apm","description":"The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it is possible the headers will not be sanitized before being sent.","status":"published","published":"2021-05-18T18:34:18Z","modified":"2023-08-30T11:37:11Z","cvss":[{"version":"3.1","score":2.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:37:02.095916Z"}],"nvd":[{"id":"CVE-2021-22133","description":"The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it is possible the headers will not be sanitized before being sent.","status":"published","published":"2021-02-10T19:15:12.09Z","modified":"2026-06-17T03:36:40.487Z","cvss":[{"version":"3.1","score":2.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"},{"version":"2.0","score":2.7,"vector":"AV:A/AC:L/Au:S/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:06:50.031227Z"}],"osv":[{"id":"GHSA-qqc5-rgcc-cjqh","title":"Information Disclosure in go.elastic.co/apm","description":"The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it is possible the headers will not be sanitized before being sent.","status":"published","published":"2021-05-18T18:34:18Z","modified":"2023-11-08T04:04:54.317159Z","cvss":[{"version":"3.1","score":2.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"GO-2022-0706","title":"Information disclosure in go.elastic.co/apm","description":"Sensitive HTTP headers may not be properly sanitized before being sent to the APM server if the program panics.","status":"published","published":"2021-05-18T18:34:18Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}