Filebeat
Monthly
Memory exhaustion denial of service in Filebeat's HTTP ingestion endpoint allows an authenticated low-privileged attacker to crash the Filebeat process by sending specially crafted compressed payloads that trigger unbounded decompression (a decompression-bomb / zip-bomb pattern). Affected versions span the 8.x and 9.x branches, with patched releases 8.19.18 and 9.3.1 published under Elastic Security Advisory ESA-2026-165. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is constrained to attackers who can reach the HTTP input endpoint.
Filebeat versions through 7.17.9 and 8.6.2 have a flaw in httpjson input that allows the http request Authorization or Proxy-Authorization header contents to be leaked in the logs when debug logging. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
Memory exhaustion denial of service in Filebeat's HTTP ingestion endpoint allows an authenticated low-privileged attacker to crash the Filebeat process by sending specially crafted compressed payloads that trigger unbounded decompression (a decompression-bomb / zip-bomb pattern). Affected versions span the 8.x and 9.x branches, with patched releases 8.19.18 and 9.3.1 published under Elastic Security Advisory ESA-2026-165. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is constrained to attackers who can reach the HTTP input endpoint.
Filebeat versions through 7.17.9 and 8.6.2 have a flaw in httpjson input that allows the http request Authorization or Proxy-Authorization header contents to be leaked in the logs when debug logging. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.