Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-0528

Improper Input Validation in Metricbeat Leading to Denial of Service

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
elastic

Description

Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input Validation (CWE-20) exists in the Prometheus helper module that can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed metric data.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Elastic Metricbeat

Default version status: unaffected

  • 7.0.0 to ≤ 7.17.29affected
  • 8.0.0 to ≤ 8.19.9affected
  • 9.0.0 to ≤ 9.1.9affected
  • 9.2.0 to ≤ 9.2.3affected

References