Only the latest release receives security fixes.

Please do not report security vulnerabilities through public GitHub issues.

Preferred: use GitHub private vulnerability reporting — go to the repository's Security tab and choose "Report a vulnerability". Alternatively, email the maintainer at allamiro@gmail.com with the subject line "jsoncef security".

Include as much of the following as you can:

• A description of the issue and its impact.
• Steps to reproduce, ideally with a sample JSON event or log line and the command or API call used.
• The version or commit you tested against.

You can expect an acknowledgement within 7 days. Once a fix is available, the vulnerability will be disclosed in the release notes and, where appropriate, a GitHub security advisory. Please allow time for a fix to be released before public disclosure.

jsoncef treats all log content as untrusted input:

• Values placed into CEF extension fields are escaped (backslash, equals sign) and CR/LF are encoded as \r/\n.
• Values placed into CEF header fields are escaped (backslash, pipe) and CR/LF are replaced, so crafted log messages cannot forge CEF header fields or split records.
• Extension keys are normalized to alphanumeric characters so field names from untrusted JSON cannot inject separators.
• Malformed or unparseable lines fall back to a tagged parse-error event instead of aborting the stream (unless --strict is set).