What is GHSA-q7g5-jq6p-6wvx?

GHSA-q7g5-jq6p-6wvx is a security advisory published by GitHub Security Advisories with Medium severity. Graylog's Authenticated HTTP inputs ingest message even if Authorization header is missing or has wrong value

Which CVE IDs does GHSA-q7g5-jq6p-6wvx cover?

GHSA-q7g5-jq6p-6wvx covers the following CVE IDs: CVE-2025-30373. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q7g5-jq6p-6wvx?

GHSA-q7g5-jq6p-6wvx has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-q7g5-jq6p-6wvx?

GHSA-q7g5-jq6p-6wvx affects 1 product, including: maven/org.graylog2:graylog2-server:\u003e= 6.1.0, \u003c 6.1.9.

GHSA-q7g5-jq6p-6wvxMediumCVSS 6.5

Graylog's Authenticated HTTP inputs ingest message even if Authorization header is missing or has wrong value

Vendor

GitHub Security Advisories

Published

April 7, 2025

Last Modified

May 13, 2025

🔗 CVE IDs covered (1)

CVE-2025-30373 →

📋 Description

Impact

Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specified value to authenticate HTTP-based ingestion. Unfortunately, even though in cases of a missing header or a wrong value the correct HTTP response (401) is returned, the message will be ingested nonetheless.

Patches

Workarounds

Disabling http-based inputs and allow only authenticated pull-based inputs.

Analysis provided by Fabian Yamaguchi - Whirly Labs (Pty) Ltd

🎯 Affected products1

maven/org.graylog2:graylog2-server:>= 6.1.0, < 6.1.9

🔗 References (4)

https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-q7g5-jq6p-6wvx
https://nvd.nist.gov/vuln/detail/CVE-2025-30373
https://github.com/Graylog2/graylog2-server/commit/31bc13d3cd6f550ec83473d0f8666cd3ebf50f10
https://github.com/advisories/GHSA-q7g5-jq6p-6wvx