CVE-2026-78588
Received Received - Intake

Allocation of Resources Without Limits in Filebeat

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Elastic

Description
Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker able to reach the Filebeat HTTP ingestion endpoint could send specially crafted compressed requests that exhaust the memory resources of the Filebeat process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-78588
EUVD
EUVD-2026-70066

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
elastic filebeat *
elastic filebeat 8.19
elastic filebeat to 9.3.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78588 is a denial-of-service vulnerability in Filebeat caused by excessive memory allocation. An attacker can exploit it by sending specially crafted compressed requests to the HTTP ingestion endpoint, which is disabled by default but may be enabled in some configurations. This leads to resource exhaustion in the Filebeat process.

Detection Guidance

Check Filebeat version with 'filebeat version' command. Monitor memory usage for unexpected spikes. Inspect HTTP endpoint logs if enabled. Look for excessive allocation patterns in system logs.

Impact Analysis

If exploited, this vulnerability can cause Filebeat to consume excessive memory, leading to degraded performance or complete denial of service. Systems relying on Filebeat for log ingestion may experience disruptions, impacting monitoring and data collection capabilities.

Mitigation Strategies

Upgrade Filebeat to versions 8.19.18 or 9.3.1. If immediate upgrade is not possible, disable the HTTP ingestion endpoint in Filebeat configuration. Restrict network access to the HTTP endpoint if enabled.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78588. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart