CVSS 3.1
5.7 mediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCVE-2026-26933
Medium (5.7) in elasticsearch packetbeat. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/elastic/beats/v7 7.0.0-alpha2.0.20260126223743-dec1b31111ec.
Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker with the ability to send specially crafted, malformed network packets to a monitored network interface can trigger out-of-bounds read operations, resulting in application crashes or resource exhaustion. This requires the attacker to be positioned on the same network segment as the Packetbeat deployment or to control traffic routed to monitored interfaces.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
- CWE
- CWE-129
- Published
- Modified
- Record from
- the NVD, synced
Affected
- elasticsearch:packetbeat
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-27qj-9gvp-8rh9 | Go | github.com/elastic/beats/v7 | <7.0.0-alpha2.0.20260126223743-dec1b31111ec | 7.0.0-alpha2.0.20260126223743-dec1b31111ec |
| GO-2026-4789 | Go | github.com/elastic/beats | all versions | no fix published |
| GO-2026-4789 | Go | github.com/elastic/beats/v7 | <7.0.0-alpha2.0.20260126223743-dec1b31111ec | 7.0.0-alpha2.0.20260126223743-dec1b31111ec |