CVE-2026-26933
Received Received - Intake
Improper Array Index Validation in Packetbeat Causes DoS

Publication date: 2026-03-19

Last updated on: 2026-03-23

Assigner: Elastic

Description
Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker with the ability to send specially crafted, malformed network packets to a monitored network interface can trigger out-of-bounds read operations, resulting in application crashes or resource exhaustion. This requires the attacker to be positioned on the same network segment as the Packetbeat deployment or to control traffic routed to monitored interfaces.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-19
Last Modified
2026-03-23
Generated
2026-06-16
AI Q&A
2026-03-19
EPSS Evaluated
2026-06-15
NVD
CVE-2026-26933
EUVD
EUVD-2026-13142
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
elasticsearch packetbeat From 8.0.0 (inc) to 8.19.11 (exc)
elasticsearch packetbeat From 9.0.0 (inc) to 9.2.5 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-26933 is an improper validation of array index vulnerability (CWE-129) found in multiple protocol parser components of Packetbeat. This flaw allows an attacker to send specially crafted, malformed network packets to a monitored network interface, which triggers out-of-bounds read operations. These operations can cause the Packetbeat application to crash or exhaust system resources, leading to a Denial of Service (DoS).

To exploit this vulnerability, the attacker must be on the same network segment as the Packetbeat deployment or control traffic routed to the monitored interfaces. The vulnerability affects Packetbeat versions 8.0.0 through 8.19.10 and 9.0.0 through 9.2.4, and is resolved in versions 8.19.11 and 9.2.5.

Impact Analysis

This vulnerability can impact you by causing Denial of Service (DoS) conditions in your Packetbeat deployment. Specifically, an attacker can cause the Packetbeat application to crash or consume excessive resources by sending malformed network packets, which leads to out-of-bounds read operations.

The impact is on availability, meaning that Packetbeat may become unavailable or unstable, potentially disrupting network monitoring and analysis functions. This can affect the reliability of your network security and monitoring infrastructure.

Compliance Impact

I don't know

Detection Guidance

This vulnerability can be detected by monitoring for frequent Packetbeat panic or crash events, error messages related to index out of range or slice bounds violations, and repeated Packetbeat process restarts.

While specific commands are not provided, you can check Packetbeat logs for such error messages and monitor the process status to identify abnormal restarts or crashes.

Mitigation Strategies

Immediate mitigation steps include upgrading Packetbeat to versions 8.19.11 or 9.2.5 where the issue is resolved.

If upgrading is not possible immediately, implement network segmentation to ensure Packetbeat monitors only trusted network segments and apply network-level controls to block untrusted traffic to monitored interfaces.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-26933. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart