| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/elastic/beats | all versions | |
| github.com/elastic/beats/v7 | ≥ 8.0.0, < 8.19.10≥ 9.0.0, < 9.1.10≥ 9.2.0, < 9.2.4< 7.0.0-alpha2.0.20251217054608-6e42552a23ce | 8.19.109.1.109.2.47.0.0-alpha2.0.20251217054608-6e42552a23ce |
| kibana | ≥ 7.0.0, < 7.17.29≥ 8.0.0, < 8.19.10≥ 9.0.0, < 9.1.10≥ 9.2.0, < 9.2.4 | 7.17.298.19.109.1.109.2.4 |
Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input Validation (CWE-20) exists in the Prometheus helper module that can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed metric data.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free