CVE-2026-26933
Improper Validation of Array Index in Packetbeat Leading to Denial of Service
CVSS Score
5.7
EPSS Score
0.0%
EPSS Percentile
0th
Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker with the ability to send specially crafted, malformed network packets to a monitored network interface can trigger out-of-bounds read operations, resulting in application crashes or resource exhaustion. This requires the attacker to be positioned on the same network segment as the Packetbeat deployment or to control traffic routed to monitored interfaces.
| CWE | CWE-129 |
| Vendor | elastic |
| Product | packetbeat |
| Published | Mar 19, 2026 |
| Last Updated | Mar 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for elastic packetbeat
Be the first to know when new medium vulnerabilities affecting elastic packetbeat are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
Elastic / Packetbeat
9.0.0 ≤ 9.2.4 8.0.0 ≤ 8.19.10