{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26932", "assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a", "state": "PUBLISHED", "assignerShortName": "elastic", "dateReserved": "2026-02-16T16:42:05.773Z", "datePublished": "2026-02-26T16:59:55.310Z", "dateUpdated": "2026-02-26T18:28:12.222Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Packetbeat", "vendor": "Elastic", "versions": [{"lessThanOrEqual": "9.2.4", "status": "affected", "version": "9.0.0", "versionType": "semver"}, {"lessThanOrEqual": "8.19.10", "status": "affected", "version": "8.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted packet causing a Go runtime panic that terminates the Packetbeat process. This vulnerability requires the pgsql protocol to be explicitly enabled and configured to monitor traffic on the targeted port.</p>"}], "value": "Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted packet causing a Go runtime panic that terminates the Packetbeat process. This vulnerability requires the pgsql protocol to be explicitly enabled and configured to monitor traffic on the targeted port."}], "impacts": [{"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "CAPEC-153 Input Data Manipulation"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 5.7, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-129", "description": "CWE-129 Improper Validation of Array Index", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a", "shortName": "elastic", "dateUpdated": "2026-02-26T16:59:55.310Z"}, "references": [{"url": "https://discuss.elastic.co/t/packetbeat-8-19-11-9-2-5-security-update-esa-2026-10/385247"}], "credits": [{"lang": "en", "value": "giant_anteater", "type": "reporter"}], "source": {"discovery": "Elastic"}, "title": "Improper Validation of Array Index in Packetbeat Leading to Denial of Service", "x_generator": {"engine": "Elastic CVE Publisher 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26932", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T17:51:18.734651Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T18:28:12.222Z"}}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elasticsearch:packetbeat:*:*:*:*:*:*:*:*", "matchCriteriaId": "5B3AF1B0-F18A-41C2-B4AC-0156C95D7153", "versionEndExcluding": "8.19.11", "versionStartIncluding": "8.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:elasticsearch:packetbeat:*:*:*:*:*:*:*:*", "matchCriteriaId": "4936046E-0E8D-4A75-8FD4-F4266B47A8FE", "versionEndExcluding": "9.2.5", "versionStartIncluding": "9.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted packet causing a Go runtime panic that terminates the Packetbeat process. This vulnerability requires the pgsql protocol to be explicitly enabled and configured to monitor traffic on the targeted port."}, {"lang": "es", "value": "Validaci\u00f3n incorrecta de \u00edndice de array (CWE-129) en el analizador del protocolo PostgreSQL en Packetbeat puede conducir a denegaci\u00f3n de servicio a trav\u00e9s de manipulaci\u00f3n de datos de entrada (CAPEC-153). Un atacante puede enviar un paquete especialmente dise\u00f1ado causando un p\u00e1nico en tiempo de ejecuci\u00f3n de Go que termina el proceso de Packetbeat. Esta vulnerabilidad requiere que el protocolo pgsql est\u00e9 expl\u00edcitamente habilitado y configurado para monitorear el tr\u00e1fico en el puerto objetivo."}], "id": "CVE-2026-26932", "lastModified": "2026-03-12T20:23:24.030", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.6, "source": "security@elastic.co", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-02-26T18:23:07.470", "references": [{"source": "security@elastic.co", "tags": ["Vendor Advisory"], "url": "https://discuss.elastic.co/t/packetbeat-8-19-11-9-2-5-security-update-esa-2026-10/385247"}], "sourceIdentifier": "security@elastic.co", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-129"}], "source": "security@elastic.co", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.0,9.2.4]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.19.10]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Packetbeat", "source": "cna", "vendor": "Elastic"}, "product": "packetbeat", "vendor": "elastic"}], "analysis": {"en": {"generated_at": "2026-04-17T14:19:55.774139+00:00", "value": {"mitigation_remediation": ["Apply the latest Packetbeat update to include the vendor\u2011released fix.", "If PostgreSQL monitoring is not required, disable the pgsql protocol in the Packetbeat configuration.", "Restrict the network interface or IP range that Packetbeat listens on to trusted sources only, reducing the surface for malicious packets."], "summary": {"action": "Patch Immediately", "impact": "Denial of Service (service interruption)"}, "threat_synthesis": {"affected_systems": "Elastic Packetbeat is affected. The flaw exists in any build where the PostgreSQL protocol is explicitly enabled and configured to monitor traffic on the chosen port. No specific version range is listed, so all deployed Packetbeat instances with PostgreSQL monitoring enabled should be considered potentially impacted.", "description_and_impact": "Improper validation of an array index in Packetbeat's PostgreSQL protocol parser can be triggered by an attacker who sends a specially crafted packet. The vulnerability, identified as CWE\u2011129, causes a Go runtime panic that terminates the Packetbeat process, resulting in a denial of service to the monitoring service.", "risk_and_exploitability": "The CVSS base score is 5.7, indicating a moderate impact. The EPSS score is less than 1\u202f%, suggesting a very low probability of exploitation at the time of analysis. Packetbeat is not listed in the CISA KEV catalog. The attack vector is inferred to be network-based; an attacker must send a malicious packet to the port that Packetbeat is monitoring. Because the exploit requires the protocol to be enabled, the risk is limited to environments where PostgreSQL traffic monitoring is in use."}}}}, "created": "2026-02-27T09:07:23.631363+00:00", "updated": "2026-04-17T14:30:20.819236+00:00", "vendors": ["elastic", "elastic$PRODUCT$packetbeat"]}