Medium severity · published Mar 19, 2026
CVE-2026-26933
Improper Validation of Array Index in Packetbeat Leading to Denial of Service
5.7
CVSS
0.3%
EPSS
No
On KEV
Description
Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker with the ability to send specially crafted, malformed network packets to a monitored network interface can trigger out-of-bounds read operations, resulting in application crashes or resource exhaustion. This requires the attacker to be positioned on the same network segment as the Packetbeat deployment or to control traffic routed to monitored interfaces.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Packetbeat · Elastic
9.0.0 through 9.2.4; 8.0.0 through 8.19.10 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-26933
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-26933
Vendor Advisory
https://discuss.elastic.co/t/packetbeat-8-19-11-9-2-5-security-update-esa-2026-11/385533
More from Packetbeat
7.5
CVE-2026-26932
Improper Validation of Array Index in Packetbeat Leading to Denial of Service
6.5
CVE-2026-0529
Improper Validation of Array Index in Packetbeat Leading to Overflow Buffers
6.5
CVE-2025-68382
Packetbeat Out-of-bounds Read
6.5
CVE-2025-68381
Packetbeat Improper Bounds Check
5.3
CVE-2025-68388
Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC-130) of memory and CPU via the…
