--- title: Security bulletins source: https://docs.newrelic.com/docs/security/security-privacy/information-security/security-bulletins --- This document contains important information regarding security vulnerabilities that could affect some versions of New Relic products and service. Security bulletins are a way for us to let you know about security vulnerabilities, remediation strategies, and applicable updates for affected software. For more information, see our documentation about [security, data privacy, and compliance](https://docs.newrelic.com/docs/security), or visit the [New Relic security website](https://newrelic.com/security). ## Get security notifications [#notifications] To get notified about new bulletins, subscribe to the [ RSS feed](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/feed.xml). ## General These bulletins apply to multiple New Relic features or capabilities: | Security bulletin | Summary | | -------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------- | | [NR23-01 — Security Advisory](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr23-01-security-advisory) | Advisory related to security investigation concluded January 31, 2024 | ## APM Security bulletins for our [APM](https://docs.newrelic.com/docs/apm/new-relic-apm/getting-started/introduction-new-relic-apm) agents include a [vulnerability rating](#severity_ratings). | Security bulletin | Summary and related release notes | Rating | | -------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | | [NRSG22-01](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nrsg2202-01) | New Relic recommends that customers who deploy the .NET Agent in a configuration using Microsoft Extensions Logging (MEL) should update to version 10.1.0 or later. | Low | | [NR21-03](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr21-03), original date 12/10/2021 | The Java agent use of the Apache log4j logging framework and procedures to address CVE-2021-44228 and CVE-2021-45046. Bulletin includes action items and links to related release notes. | Critical | | [NR21-02](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr21-02), 4/26/2021 | The Java agent implements a YAML parser that may lead to limited code execution when parsing a crafted YAML payload. | Low | | [NR20-02](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr20-02), 8/20/2020 | The agent does not remove the URI from transaction traces when `request.uri` has been disabled in attribute configuration. See the [Node.js agent release notes](https://docs.newrelic.com/docs/release-notes/agent-release-notes/nodejs-release-notes). | Medium | | [NR20-01](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr20-01), 1/16/2020 | The agent may capture full SQL queries when an exception occurs. See the [.NET agent release notes](https://docs.newrelic.com/docs/release-notes/agent-release-notes/net-release-notes). | Medium | | [NR19-05](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr19-05), 8/26/2019 | Incorrect metric names created with non-parameterized queries may contain sensitive information. See the [.NET agent release notes](https://docs.newrelic.com/docs/release-notes/agent-release-notes/net-release-notes). | Medium | | [NR19-03](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr19-03), 4/22/2019 | Query obfuscation may fail in Microsoft SQL server. See the [.NET agent](https://docs.newrelic.com/docs/release-notes/agent-release-notes/net-release-notes) release notes. | Medium | | [NR19-02](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr19-02), 4/1/2019 | Segment attributes may include request parameters in high-security mode or when using configurable security policies. See the [Node.js agent release notes](https://docs.newrelic.com/docs/release-notes/agent-release-notes/nodejs-release-notes). | Medium | | [NR19-01](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr19-01), 1/9/2019 | OpenRasta instrumentation may capture query strings. See the [.NET agent release notes](https://docs.newrelic.com/docs/release-notes/agent-release-notes/net-release-notes). | Medium | | [NR18-09](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr18-09), 5/2/2018 | The agent may capture sensitive data when `record_sql` is set to `off`. See the [Java agent release notes](https://docs.newrelic.com/docs/release-notes/agent-release-notes/java-release-notes). | Low | | [NR18-08](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr18-08), 4/12/2018 | The agent uses a vulnerable `https-proxy-agent` Node.js module. See the [Node.js agent release notes](https://docs.newrelic.com/docs/release-notes/agent-release-notes/nodejs-release-notes). | Low | | [NR18-07](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr18-07), 3/7/2018 | The agents may report DB query results to New Relic or reissue an SQL statement. See the release notes for the [Python](https://docs.newrelic.com/docs/release-notes/agent-release-notes/net-release-notes), [Java](https://docs.newrelic.com/docs/release-notes/agent-release-notes/java-release-notes), and [.NET](https://docs.newrelic.com/docs/release-notes/agent-release-notes/net-release-notes) agents. | High | | [NR18-06](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr18-06), 3/5/2018 | The agent may capture all transaction attributes. See the [Node.js agent release notes](https://docs.newrelic.com/docs/release-notes/agent-release-notes/nodejs-release-notes). | High | | [NR18-04](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr18-04), 1/22/2018 | Error messages are not removed in high-security mode. See the [.NET agent release notes](https://docs.newrelic.com/docs/release-notes/agent-release-notes/net-release-notes). | Medium | | [NR18-02](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr18-02), 1/9/2018 | The agent may not obfuscate SQL params with SQLite. See the [Python agent release notes](https://docs.newrelic.com/docs/release-notes/agent-release-notes/python-release-notes). | Medium | | [NR18-01](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr18-01), 1/9/2018 | The agent may capture custom API parameters in high-security mode. See the [Python agent release notes](https://docs.newrelic.com/docs/release-notes/agent-release-notes/python-release-notes). | Medium | | [NR17-06](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr17-06), 12/18/2017 | The agent captures external HTTP request parameters during a transaction trace. See the [.NET agent release notes](https://docs.newrelic.com/docs/release-notes/agent-release-notes/net-release-notes). | Medium | | [NR17-05](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr17-05), 5/30/2017 | The agent may capture full SQL queries when an exception occurs. See the [Java agent release notes](https://docs.newrelic.com/docs/release-notes/agent-release-notes/java-release-notes). | High | | [NR17-04](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr17-04), 5/5/2017 | The agent captures WCF service request parameters during a `TransactionError`. See the [.NET agent release notes](https://docs.newrelic.com/docs/release-notes/agent-release-notes/net-release-notes). | Medium | | [NR17-03](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr17-03), 2/9/2017 | MongoDB aggregate queries not obfuscated. See the [Ruby agent release notes](https://docs.newrelic.com/docs/release-notes/agent-release-notes/ruby-release-notes). | Low | | [NR17-02](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr17-02), 1/12/2017 | Query parameters are not removed from the `referer` attribute in error trace. See the [.NET agent release notes](https://docs.newrelic.com/docs/release-notes/agent-release-notes/net-release-notes). | Medium | | [NR17-01](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr17-01), 1/12/2017 | Query parameters are not removed from the `referer` attribute in error trace. See the [Node.js agent release notes](https://docs.newrelic.com/docs/release-notes/agent-release-notes/nodejs-release-notes). | Medium | ## Infrastructure monitoring [#infrastructure] Security bulletins for [infrastructure monitoring](https://docs.newrelic.com/docs/infrastructure/new-relic-infrastructure/getting-started/introduction-new-relic-infrastructure) include a [vulnerability rating](#severity_ratings). | Security bulletin | Summary and related release notes | Rating | | ---------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | | [NR25-02](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr25-02), 12/11/25 | New Relic has released new versions of several log forwarding services to address Fluent Bit plugin vulnerabilities (CVE-2025-12969, CVE-2025-12970, CVE-2025-12972, CVE-2025-12977, CVE-2025-12978). | High | | [NR25-01](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr25-01), 3/1/25 | New Relic has released new versions of several log forwarding services to eliminate use of recently announced [plugin vulnerabilties in versions of Fluent Bit](https://fluentbit.io/announcements/v3.2.7/). | High | | [NR24-01](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr24-01), 6/8/24 | New Relic has released new versions of several log forwarding services to eliminate use of a recently announced [vulnerable version of Fluent Bit](https://nvd.nist.gov/vuln/detail/CVE-2024-4323). | High | | [NR18-12](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr18-12), 11/28/18 | Windows agent may follow unprivileged hard links or junction folders. See the [agent release notes](https://docs.newrelic.com/docs/release-notes/infrastructure-release-notes/infrastructure-agent-release-notes) for infrastructuring monitoring | Low | | [NR18-11](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr18-11), 10/8/18 | Windows agent may execute privileged binaries in the system path. See the [agent release notes](https://docs.newrelic.com/docs/release-notes/infrastructure-release-notes/infrastructure-agent-release-notes) for infrastructuring monitoring. | Medium | | [NR18-10](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr18-10), 6/18/18 | Hard-coded file path allows for user-controlled configuration. See the [agent release notes](https://docs.newrelic.com/docs/release-notes/infrastructure-release-notes/infrastructure-agent-release-notes) for infrastructuring monitoring. | High | | [NR18-05](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr18-05), 2/8/2018 | Command line options may be captured. See the [agent release notes](https://docs.newrelic.com/docs/release-notes/infrastructure-release-notes/infrastructure-agent-release-notes) for infrastructuring monitoring. | High | ## Browser monitoring [#browser] Security bulletins for [browser monitoring](https://docs.newrelic.com/docs/browser/) include a [vulnerability rating](#severity_ratings). | Security bulletin | Summary and related release notes | Rating | | ---------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | ------ | | [NR21-01](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr21-01), 3/9/2021 | The agent does not properly sanitize local file URIs when an instrumented HTML page is opened directly from the operating systems's filesystem. | Medium | ## Synthetic monitoring [#synthetics] Security bulletins for [synthetic monitoring](https://docs.newrelic.com/docs/synthetics/new-relic-synthetics/getting-started/introduction-new-relic-synthetics) include a [vulnerability rating](#severity_ratings). | Security bulletin | Summary and related release notes | Rating | | --------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | | [NR26-05](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr26-05), 05/10/2026 | Procedures to address a vulnerability in Linux kernel (CVE-2026-31431) affecting New Relic Synthetic Monitoring. | High | | [NR26-04](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr26-04), 04/04/2026 | Procedures to address a critical use-after-free vulnerability in Google Chrome (CVE-2026-5281) affecting New Relic Synthetic Monitoring. | Critical | | [NR22-01](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr22-01/), 1/13/2022 | Containerized private minion (CPM) procedures to specifically remove subdependencies on log4j version 1.2.17 | High | | [NR21-04](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr21-04/), original date 12/13/2021 | Containerized private minion (CPM) procedures to address CVE-2021-44228 and CVE-2021-45046. Bulletin includes action items and links to related release notes. | Critical | | [NR19-04](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr19-04), 7/22/2019 | Sensitive data may appear in logs. See the release notes for [containerized private minions](https://docs.newrelic.com/docs/release-notes/synthetics-release-notes/containerized-private-minions-release-notes). | Medium | | [NR18-03](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr18-03), 1/12/2018 | Update private minions for Meltdown (CVE-2017-5754). See the release notes for [containerized private minions](https://docs.newrelic.com/docs/release-notes/synthetics-release-notes/containerized-private-minions-release-notes). | High | ## Other [#other] Security bulletins in this general category include a [vulnerability rating](#severity_ratings). | Security bulletin | Summary and related release notes | Rating | | ------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------- | ------ | | [NR24-02](https://docs.newrelic.com/docs/security/new-relic-security/security-bulletins/security-bulletin-nr24-02), 07/18/2024 | Procedures to address a vulnerability in OpenSSH that affects New Relic Salesforce Exporter. | High | ## Security vulnerability ratings [#severity_ratings] At New Relic, we use four levels to rate security vulnerability. | Rating | Description | | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical | A vulnerability in a New Relic product or service that could be exploited to compromise the confidentiality or integrity of your data. | | High | Atypical or unintended information is likely to be received by New Relic, potentially compromising the confidentiality or integrity of your data. | | Medium | Atypical or unintended information could be received by New Relic, but the risk of compromise is mitigated by default configuration or standard security practices. | | Low | Atypical or unintended information may be received by New Relic, but the vulnerability would be difficult to exploit, or it would have minimal impact. | ## Report security vulnerabilities to New Relic [#report] New Relic is committed to the security of our customers and your data. If you believe you have found a security vulnerability in one of our products, services, or websites, we welcome and greatly appreciate you reporting it to our coordinated disclosure program. For more information, see our documentation about [reporting security vulnerabilities](https://docs.newrelic.com/docs/security/security-privacy/information-security/report-security-vulnerabilities/).