Fleet and Elastic Agent 8.19.21+build202609151720
edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.
Fleet and Elastic Agent 8.19.21+build202609151720
editThis is an independent Elastic Agent release (IAR). Independent Elastic Agent releases deliver critical fixes for Elastic Agent and Elastic Defend independently of a full Elastic Stack release.
Security updates
edit- Elastic Defend on Linux now uses c-ares 1.34.8, fixing CVE-2024-25629 (out-of-bounds read in DNS config parsing). The gRPC-bundled c-ares snapshot (~1.19) is unchanged and is tracked separately pending a gRPC version upgrade.
Enhancements
edit- Add experimental macOS 27 support to Elastic Defend.
Bug fixes
edit- Reduce Elastic Defend CPU usage and lock contention during network cache cleanup on Linux, preventing event enrichment stalls at high connection counts.
- Increase Elastic Defend event buffer size.
- Harden how Elastic Defend restores file ownership and permissions during malware quarantine on Linux and macOS.
- Fix a crash in Elastic Defend on Windows when processing files or processes whose paths contain CJK (Chinese, Japanese, Korean) characters.
-
Elastic Defend exception list and trusted app rules matching on
host.namenow correctly handle mixed-case values. Previously, an exception withhost.name: "MyServer"would silently fail to match because Elastic Defend normalizeshost.nameto lowercase per ECS, while Kibana’s default comparison is case-sensitive. - Add workaround to macOS Elastic Defend for Golden Gate bug breaking network connections from apps using Network.framework.