CVE-2026-26933
Improper Array Index Validation in Packetbeat Causes DoS
Publication date: 2026-03-19
Last updated on: 2026-03-23
Assigner: Elastic
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| elasticsearch | packetbeat | From 8.0.0 (inc) to 8.19.11 (exc) |
| elasticsearch | packetbeat | From 9.0.0 (inc) to 9.2.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-129 | The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-26933 is an improper validation of array index vulnerability (CWE-129) found in multiple protocol parser components of Packetbeat. This flaw allows an attacker to send specially crafted, malformed network packets to a monitored network interface, which triggers out-of-bounds read operations. These operations can cause the Packetbeat application to crash or exhaust system resources, leading to a Denial of Service (DoS).
To exploit this vulnerability, the attacker must be on the same network segment as the Packetbeat deployment or control traffic routed to the monitored interfaces. The vulnerability affects Packetbeat versions 8.0.0 through 8.19.10 and 9.0.0 through 9.2.4, and is resolved in versions 8.19.11 and 9.2.5.
How can this vulnerability impact me? :
This vulnerability can impact you by causing Denial of Service (DoS) conditions in your Packetbeat deployment. Specifically, an attacker can cause the Packetbeat application to crash or consume excessive resources by sending malformed network packets, which leads to out-of-bounds read operations.
The impact is on availability, meaning that Packetbeat may become unavailable or unstable, potentially disrupting network monitoring and analysis functions. This can affect the reliability of your network security and monitoring infrastructure.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for frequent Packetbeat panic or crash events, error messages related to index out of range or slice bounds violations, and repeated Packetbeat process restarts.
While specific commands are not provided, you can check Packetbeat logs for such error messages and monitor the process status to identify abnormal restarts or crashes.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Packetbeat to versions 8.19.11 or 9.2.5 where the issue is resolved.
If upgrading is not possible immediately, implement network segmentation to ensure Packetbeat monitors only trusted network segments and apply network-level controls to block untrusted traffic to monitored interfaces.