CVE-2026-26931 Memory Allocation with Excessive Size Value in Metricbeat Leading to Denial of Service
Attackers can cause denial of service in Metricbeat by triggering excessive memory allocation in the Prometheus remote_write handler.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-26931?
CVE-2026-26931 is a medium-severity denial of service vulnerability in Elastic Metricbeat, published on 19 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Memory Allocation with Excessive Size Value (CWE-789) in the Prometheus remote_write HTTP handler in Metricbeat can lead Denial of Service via Excessive Allocation (CAPEC-130).
Weakness: CWE-789
Which versions are affected by CVE-2026-26931?
4 open source packages ship an affected version, including github.com/elastic/beats/v7 and github.com/elastic/beats. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/elastic/beats/v7 Go | All versions | 7.0.0-alpha2.0.20260112100137-de072c4e371e |
github.com/elastic/beats/v7 Go | All versions | 7.0.0-alpha2.0.20260112100137-de072c4e371e |
github.com/elastic/beats/v7 Go | All versions | 7.0.0-alpha2.0.20260112100137-de072c4e371e |
github.com/elastic/beats Go | All versions | None |
Products include Elastic Metricbeat.
How do I fix CVE-2026-26931?
Upgrade github.com/elastic/beats/v7 to 7.0.0-alpha2.0.20260112100137-de072c4e371e or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-26931 being exploited?
There is no known exploitation of CVE-2026-26931 in the wild and no public exploit code.
Sources
Also known as ECHO-6e6e-7e35-9600, GHSA-5vrw-qjxw-89r5, GO-2026-4790, MINI-3m25-27rr-jm6j, MINI-45vw-48cp-8955, MINI-6p4v-rj56-9f72 and 11 more.