CVE-2026-26933 Improper Validation of Array Index in Packetbeat Leading to Denial of Service
An attacker on the same network segment can crash Packetbeat by sending malformed network packets that trigger out-of-bounds reads in protocol parsers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-26933?
CVE-2026-26933 is a medium-severity denial of service vulnerability in Elastic Packetbeat, published on 19 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker with the ability to send specially crafted, malformed network packets to a monitored network interface can trigger out-of-bounds read operations, resulting in application crashes or resource exhaustion. This requires the attacker to be positioned on the same network segment as the Packetbeat deployment or to control traffic routed to monitored interfaces.
Weakness: CWE-129
Which versions are affected by CVE-2026-26933?
4 open source packages ship an affected version, including github.com/elastic/beats/v7 and github.com/elastic/beats. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/elastic/beats/v7 Go | All versions | 7.0.0-alpha2.0.20260126223743-dec1b31111ec |
github.com/elastic/beats/v7 Go | All versions | 7.0.0-alpha2.0.20260126223743-dec1b31111ec |
github.com/elastic/beats/v7 Go | All versions | 7.0.0-alpha2.0.20260126223743-dec1b31111ec |
github.com/elastic/beats Go | All versions | None |
Products include Elasticsearch Packetbeat.
How do I fix CVE-2026-26933?
Upgrade github.com/elastic/beats/v7 to 7.0.0-alpha2.0.20260126223743-dec1b31111ec or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-26933 being exploited?
There is no known exploitation of CVE-2026-26933 in the wild and no public exploit code.
Other vulnerabilities in Elastic Packetbeat
- CVE-2017-11480 Denial of Service in Packetbeat
- CVE-2025-68381 Packetbeat Improper Bounds Check
- CVE-2025-68382 Packetbeat Out-of-bounds Read
- CVE-2026-26932 Improper Validation of Array Index in Packetbeat Leading to Denial of Service
- CVE-2025-68388 Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments
Sources
Also known as ECHO-2325-2fc0-293f, GHSA-27qj-9gvp-8rh9, GO-2026-4789, MINI-436j-j77x-w2j5, MINI-5m6m-f2j5-vf7p, MINI-97gv-cprr-p257 and 7 more.