EUVD-2026-13142
GHSA-27qj-9gvp-8rh9
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker with the ability to send specially crafted, malformed network packets to a monitored network interface can trigger out-of-bounds read operations, resulting in application crashes or resource exhaustion. This requires the attacker to be positioned on the same network segment as the Packetbeat deployment or to control traffic routed to monitored interfaces.
AnalysisAI
Packetbeat contains an improper array index validation vulnerability (CWE-129) in its protocol parser components that allows attackers to trigger out-of-bounds read operations through specially crafted network packets. Affected versions include Packetbeat 8.0.0 through 8.19.10 and 9.0.0 through 9.2.4, with the vulnerability requiring network-level access or traffic control to the monitored interface. An attacker exploiting this flaw can cause denial of service through application crashes or resource exhaustion; while the CVSS score of 5.7 indicates moderate severity and there is no indication of widespread active exploitation in public KEV databases, the patch availability through Elastic's security update (ESA-2026-11) released in version 8.19.11 and 9.2.5 suggests this is a confirmed and prioritized vulnerability worthy of timely remediation.
Technical ContextAI
Packetbeat is Elastic's network packet analysis and monitoring tool (cpe:2.3:a:elastic:packetbeat:*:*:*:*:*:*:*:*) that processes network traffic across multiple protocol parsers to extract application-layer insights. The vulnerability resides in CWE-129 (Improper Validation of Array Index), a memory safety issue where parser logic fails to validate array indices before access, enabling out-of-bounds reads when malformed packets are processed. This class of defect is common in C/C++ network parsing code where protocol dissectors make assumptions about packet structure without robust bounds checking. The vulnerability affects the core packet processing engine across multiple protocol handlers, making it a systemic issue rather than a single-protocol flaw.
RemediationAI
Immediately upgrade Packetbeat to version 8.19.11 or 9.2.5 or later as released in Elastic security update ESA-2026-11 (https://discuss.elastic.co/t/packetbeat-8-19-11-9-2-5-security-update-esa-2026-11/385533). For environments unable to patch immediately, restrict network access to monitored interfaces only to trusted traffic sources and network segments, limit which users can send traffic to Packetbeat-monitored interfaces, and implement network segmentation to isolate Packetbeat deployments from untrusted network paths. Monitor Packetbeat process logs and system metrics for crashes or unexpected restarts that may indicate exploitation attempts, and prioritize patching for Packetbeat instances monitoring high-risk or untrusted network segments.
More in Packetbeat
View allPacketbeat versions prior to 5.6.4 are affected by a denial of service flaw in the PostgreSQL protocol handler. Rated hi
Packetbeat's PostgreSQL protocol parser improperly validates array indices, allowing authenticated attackers on the same
Same weakness CWE-129 – Improper Validation of Array Index
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today