Metricbeat Allocates Memory with Excessive Size Value Leading to Denial of Service

Description

References

• nvd.nist.gov/vuln/detail/CVE-2026-26931 · ADVISORY
• elastic/beats commit de072c4 · WEB
• discuss.elastic.co/t/metricbeat-8-19-13-9-2-5-security-update-esa-2026-09/385532 · WEB
• elastic/beats · PACKAGE
• GitHub Advisory GHSA-5vrw-qjxw-89r5 · ADVISORY

Weitere Schwachstellen in github.com/elastic/beats

• CVE-2026-26933MITTEL 5.7Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial of Service via Input Data …
• CVE-2026-0528HOCH 7.5Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Mani…
• CVE-2025-68388MITTEL 5.3Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPE…
• CVE-2025-68383MITTEL 6.5Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbeat Dissect processor …
• CVE-2023-49922MITTEL 6.5An issue was discovered by Elastic whereby Beats and Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if inges…