From c22d673bb9b336a37fcc1fd9bb2c16bfecd3f2fe Mon Sep 17 00:00:00 2001 From: natasha-moore-elastic Date: Thu, 17 Sep 2026 10:56:39 +0100 Subject: [PATCH] [Security] 8.19.22 release notes Co-authored-by: Cursor --- docs/release-notes.asciidoc | 1 + docs/release-notes/8.19.asciidoc | 30 +++++++++++++++++++++++++++++- 2 files changed, 30 insertions(+), 1 deletion(-) diff --git a/docs/release-notes.asciidoc b/docs/release-notes.asciidoc index 55838c3d22..ce1938be64 100644 --- a/docs/release-notes.asciidoc +++ b/docs/release-notes.asciidoc @@ -3,6 +3,7 @@ This section summarizes the changes in each release. +* <> * <> * <> * <> diff --git a/docs/release-notes/8.19.asciidoc b/docs/release-notes/8.19.asciidoc index d6c15ab0c8..3758a201ac 100644 --- a/docs/release-notes/8.19.asciidoc +++ b/docs/release-notes/8.19.asciidoc @@ -1,6 +1,35 @@ [[release-notes-header-8.19.0]] == 8.19 +[discrete] +[[release-notes-8.19.22]] +=== 8.19.22 + +[discrete] +[[enhancements-8.19.22]] +==== Enhancements +* Adds experimental macOS 27 support to {elastic-defend}. + +[discrete] +[[bug-fixes-8.19.22]] +==== Fixes +* Fixes detection rules so a search that returns no readable shards is reported as a warning, instead of failing with `expected to find aggregations on search result` ({kibana-pull}290924[#290924]). +* Fixes bulk closing alerts that use a scripted data view runtime field in the filter, including when closing a grouped set of alerts. Previously the action reported 0 updated alerts ({kibana-pull}289549[#289549]). +* Fixes bulk closing all matching alerts so they are updated when the filter uses a data view runtime field. Previously the action reported 0 updated alerts ({kibana-pull}288946[#288946]). +* Fixes the Timeline **Correlation** tab so it shows a warning when EQL results are incomplete because shards timed out or failed ({kibana-pull}287933[#287933]). +* Fixes detection rules so they retry with a smaller page size instead of failing when an event search response is too large ({kibana-pull}287916[#287916]). +* Fixes an issue where Google Gemini 3.x models rejected requests that included tools with unconstrained string parameters ({kibana-pull}286302[#286302]). +* Reduces {elastic-defend} CPU usage and lock contention during network cache cleanup on Linux, preventing event enrichment stalls at high connection counts. +* Increases the {elastic-defend} event buffer size. +* Hardens how {elastic-defend} restores file ownership and permissions during malware quarantine on Linux and macOS. +* Fixes a crash in {elastic-defend} on Windows when processing files or processes whose paths contain CJK (Chinese, Japanese, or Korean) characters. +* Updates a `c-ares` dependency in {elastic-defend} on Linux to resolve https://github.com/c-ares/c-ares/security/advisories/GHSA-mg26-v6qh-x48q[CVE-2024-25629]. The gRPC-bundled `c-ares` snapshot (~1.19) is unchanged and is tracked separately pending a gRPC version upgrade. +* Fixes {elastic-defend} **Endpoint exceptions** and **Trusted applications** so entries that match on `host.name` handle mixed-case values. Previously, an exception with `host.name: "MyServer"` failed to match because {elastic-defend} lowercases `host.name`, while {kib}'s default comparison is case-sensitive. +* Adds a workaround in {elastic-defend} for a macOS 27 bug that could break network connections from apps using `Network.framework`. +* Fixes {elastic-defend} diagnostics bundles generated by the `elastic-endpoint diagnostics` command so they are no longer readable by unprivileged local users on Windows, Linux, and macOS. +* Fixes an issue where {elastic-defend} ignored a cached artifact and treated the lookup as a miss. +* Fixes a memory leak in {elastic-defend} process tracking on hosts with very fast process ID reuse. + [discrete] [[release-notes-8.19.21]] === 8.19.21 @@ -15,7 +44,6 @@ [[bug-fixes-8.19.21]] ==== Fixes * Fixes an issue where previously applied filters on the **Notes** page were not shown in the filter controls after navigating away and returning, even though the filters were still active ({kibana-pull}286574[#286574]). -* Fixes an issue where Google Gemini 3.x models rejected requests that included tools with unconstrained string parameters ({kibana-pull}286302[#286302]). * Fixes an issue where detection rule exception items that use **IP range** value lists with more than 200 dash-notation entries were dropped during rule execution ({kibana-pull}285178[#285178]). * Updates a `curl` dependency in {elastic-defend} to resolve https://github.com/advisories/GHSA-gv3v-x3f3-7fxm[CVE-2024-8096]. * Updates an OpenSSL dependency in {elastic-defend} to resolve multiple CVEs, including https://github.com/advisories/GHSA-f9v2-4w9p-2cwc[CVE-2026-34182] and https://github.com/advisories/GHSA-5888-36j9-c92p[CVE-2025-66199].