CVE-2017-11480 Denial of Service in Packetbeat

What is CVE-2017-11480?

CVE-2017-11480 is a high-severity denial of service vulnerability in Elastic Packetbeat, published on 8 Dec 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Packetbeat versions prior to 5.6.4 are affected by a denial of service flaw in the PostgreSQL protocol handler. If Packetbeat is listening for PostgreSQL traffic and a user is able to send arbitrary network traffic to the monitored port, the attacker could prevent Packetbeat from properly logging other PostgreSQL traffic.

Weakness: CWE-404

Which versions are affected by CVE-2017-11480?

5 open source packages ship an affected version, including github.com/elastic/beats. It affects 1 product.

Products include Elasticsearch Packetbeat.

How do I fix CVE-2017-11480?

Upgrade github.com/elastic/beats to a fixed version for your release line: 5.6.4, 6.1.0+incompatible or 6.0.0.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2017-11480 being exploited?

There is no known exploitation of CVE-2017-11480 in the wild and no public exploit code.

Other vulnerabilities in Elastic Packetbeat

• CVE-2025-68381 Packetbeat Improper Bounds Check Medium 6.5
• CVE-2025-68382 Packetbeat Out-of-bounds Read Medium 6.5
• CVE-2026-26933 Improper Validation of Array Index in Packetbeat Leading to Denial of Service Medium 5.7
• CVE-2026-26932 Improper Validation of Array Index in Packetbeat Leading to Denial of Service Medium 5.7
• CVE-2025-68388 Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9q3g-m353-cp4p, GO-2022-0643.