CVE-2025-68383 Filebeat Improper Validation of Specified Index, Position, or Offset in Input
Attackers can crash Filebeat via malformed Syslog messages or malicious Dissect patterns, requiring administrators to upgrade the software.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68383?
CVE-2025-68383 is a medium-severity denial of service vulnerability in Elastic Filebeat, published on 18 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbeat Dissect processor can allow a user to trigger a Buffer Overflow (CAPEC-100) and cause a denial of service (panic/crash) of the Filebeat process via either a malformed Syslog message or a malicious tokenizer pattern in the Dissect configuration.
Weakness: CWE-1284
Which versions are affected by CVE-2025-68383?
12 open source packages ship an affected version, including github.com/elastic/beats/v7 and github.com/elastic/beats. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/elastic/beats/v7 Go | All versions | 7.0.0-alpha2.0.20251204214633-dd3af18220bf |
github.com/elastic/beats/v7 Go | All versions | 7.0.0-alpha2.0.20251204214633-dd3af18220bf |
github.com/elastic/beats/v7 Go | All versions | 7.0.0-alpha2.0.20251204214633-dd3af18220bf |
github.com/elastic/beats/v7 Go | From 7.7.0 | 8.19.9 |
github.com/elastic/beats/v7 Go | From 7.7.0 | 8.19.9 |
github.com/elastic/beats/v7 Go | From 9.0.0 | 9.1.9 |
6 more packages
github.com/elastic/beats/v7 Go | From 9.0.0 | 9.1.9 |
github.com/elastic/beats/v7 Go | From 9.2.0 | 9.2.3 |
github.com/elastic/beats/v7 Go | From 9.2.0 | 9.2.3 |
github.com/elastic/beats Go | All versions | None |
github.com/elastic/beats Go | All versions to 7.6.2 | None |
github.com/elastic/beats Go | All versions to 7.6.2 | None |
Products include Elastic Filebeat.
How do I fix CVE-2025-68383?
Upgrade github.com/elastic/beats/v7 to a fixed version for your release line: 7.0.0-alpha2.0.20251204214633-dd3af18220bf, 8.19.9, 9.1.9 or 9.2.3.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-68383 being exploited?
There is no known exploitation of CVE-2025-68383 in the wild and no public exploit code.
Other vulnerabilities in Elastic Filebeat
Sources
Also known as GHSA-2mj3-6grc-px38, GO-2025-4252, MINI-44j9-47vc-mghf, MINI-545j-r8j5-qqpj, MINI-5g27-5jv7-cg9j, MINI-79cm-7mq3-3qh9 and 6 more.