CVE-2026-26933

Received Received - Intake

Improper Array Index Validation in Packetbeat Causes DoS

Publication date: 2026-03-19

Last updated on: 2026-03-23

Assigner: Elastic

Description

Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker with the ability to send specially crafted, malformed network packets to a monitored network interface can trigger out-of-bounds read operations, resulting in application crashes or resource exhaustion. This requires the attacker to be positioned on the same network segment as the Packetbeat deployment or to control traffic routed to monitored interfaces.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-19

Last Modified

2026-03-23

Generated

2026-07-07

AI Q&A

2026-03-19

EPSS Evaluated

2026-07-05

NVD

CVE-2026-26933

EUVD

EUVD-2026-13142

Affected Vendors & Products

Vendor	Product	Version / Range
elasticsearch	packetbeat	From 8.0.0 (inc) to 8.19.11 (exc)
elasticsearch	packetbeat	From 9.0.0 (inc) to 9.2.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-129	The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

Executive Summary

CVE-2026-26933 is an improper validation of array index vulnerability (CWE-129) found in multiple protocol parser components of Packetbeat. This flaw allows an attacker to send specially crafted, malformed network packets to a monitored network interface, which triggers out-of-bounds read operations. These operations can cause the Packetbeat application to crash or exhaust system resources, leading to a Denial of Service (DoS).

To exploit this vulnerability, the attacker must be on the same network segment as the Packetbeat deployment or control traffic routed to the monitored interfaces. The vulnerability affects Packetbeat versions 8.0.0 through 8.19.10 and 9.0.0 through 9.2.4, and is resolved in versions 8.19.11 and 9.2.5.

Impact Analysis

This vulnerability can impact you by causing Denial of Service (DoS) conditions in your Packetbeat deployment. Specifically, an attacker can cause the Packetbeat application to crash or consume excessive resources by sending malformed network packets, which leads to out-of-bounds read operations.

The impact is on availability, meaning that Packetbeat may become unavailable or unstable, potentially disrupting network monitoring and analysis functions. This can affect the reliability of your network security and monitoring infrastructure.

Compliance Impact

I don't know

Detection Guidance

This vulnerability can be detected by monitoring for frequent Packetbeat panic or crash events, error messages related to index out of range or slice bounds violations, and repeated Packetbeat process restarts.

While specific commands are not provided, you can check Packetbeat logs for such error messages and monitor the process status to identify abnormal restarts or crashes.

Mitigation Strategies

Immediate mitigation steps include upgrading Packetbeat to versions 8.19.11 or 9.2.5 where the issue is resolved.

If upgrading is not possible immediately, implement network segmentation to ensure Packetbeat monitors only trusted network segments and apply network-level controls to block untrusted traffic to monitored interfaces.

Hi! I’m here to help you understand CVE-2026-26933. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70