Packetbeat
Monthly
A single crafted AMQP packet can crash Elastic Packetbeat by triggering a null pointer dereference in its AMQP protocol parser, producing an unrecovered Go runtime panic that terminates the process and halts network telemetry collection. The flaw is rated CVSS 6.5 (availability-only) and requires no AMQP authentication, but exploitation is constrained to attackers who can inject traffic onto a network segment the sensor actually monitors and only where AMQP protocol analysis is enabled - the CVSS vector is Adjacent (AV:A), so this is not reachable against an internet-exposed service. There is no CISA KEV listing and no public exploit identified at time of analysis; the vendor has published fixed releases (8.19.24, 9.4.9, 9.5.6) under ESA-2026-208, and vuln.today prioritizes it as a this-month item rather than an emergency.
Packetbeat contains an improper array index validation vulnerability (CWE-129) in its protocol parser components that allows attackers to trigger out-of-bounds read operations through specially crafted network packets. Affected versions include Packetbeat 8.0.0 through 8.19.10 and 9.0.0 through 9.2.4, with the vulnerability requiring network-level access or traffic control to the monitored interface. An attacker exploiting this flaw can cause denial of service through application crashes or resource exhaustion; while the CVSS score of 5.7 indicates moderate severity and there is no indication of widespread active exploitation in public KEV databases, the patch availability through Elastic's security update (ESA-2026-11) released in version 8.19.11 and 9.2.5 suggests this is a confirmed and prioritized vulnerability worthy of timely remediation.
Packetbeat's PostgreSQL protocol parser improperly validates array indices, allowing authenticated attackers on the same network to crash the monitoring service by sending malicious packets. An attacker exploiting this denial-of-service vulnerability can terminate the Packetbeat process, disrupting monitoring capabilities on systems with PostgreSQL protocol monitoring enabled. No patch is currently available.
Packetbeat versions prior to 5.6.4 are affected by a denial of service flaw in the PostgreSQL protocol handler. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A single crafted AMQP packet can crash Elastic Packetbeat by triggering a null pointer dereference in its AMQP protocol parser, producing an unrecovered Go runtime panic that terminates the process and halts network telemetry collection. The flaw is rated CVSS 6.5 (availability-only) and requires no AMQP authentication, but exploitation is constrained to attackers who can inject traffic onto a network segment the sensor actually monitors and only where AMQP protocol analysis is enabled - the CVSS vector is Adjacent (AV:A), so this is not reachable against an internet-exposed service. There is no CISA KEV listing and no public exploit identified at time of analysis; the vendor has published fixed releases (8.19.24, 9.4.9, 9.5.6) under ESA-2026-208, and vuln.today prioritizes it as a this-month item rather than an emergency.
Packetbeat contains an improper array index validation vulnerability (CWE-129) in its protocol parser components that allows attackers to trigger out-of-bounds read operations through specially crafted network packets. Affected versions include Packetbeat 8.0.0 through 8.19.10 and 9.0.0 through 9.2.4, with the vulnerability requiring network-level access or traffic control to the monitored interface. An attacker exploiting this flaw can cause denial of service through application crashes or resource exhaustion; while the CVSS score of 5.7 indicates moderate severity and there is no indication of widespread active exploitation in public KEV databases, the patch availability through Elastic's security update (ESA-2026-11) released in version 8.19.11 and 9.2.5 suggests this is a confirmed and prioritized vulnerability worthy of timely remediation.
Packetbeat's PostgreSQL protocol parser improperly validates array indices, allowing authenticated attackers on the same network to crash the monitoring service by sending malicious packets. An attacker exploiting this denial-of-service vulnerability can terminate the Packetbeat process, disrupting monitoring capabilities on systems with PostgreSQL protocol monitoring enabled. No patch is currently available.
Packetbeat versions prior to 5.6.4 are affected by a denial of service flaw in the PostgreSQL protocol handler. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.