Metricbeat CVE-2026-26931

The vulnerability resides in Metricbeat's HTTP handler for Prometheus remote_write protocol integration, a feature that allows Metricbeat to receive metrics from Prometheus clients. The root cause is classified under CWE-789, which describes scenarios where an application allocates memory based on user-supplied input without proper validation or bounds checking. When a remote_write request containing an excessively large size value is processed, the handler attempts to allocate memory proportional to that value, bypassing safety checks. This is a common pattern in Go and Java applications handling HTTP payloads with Content-Length headers or size indicators in message frames. The Prometheus protocol is widely used in cloud-native and containerized environments, making this a particularly relevant vulnerability for observability infrastructure.