~ / search / GHSA-w2gr-585j-r428

GHSA-w2gr-585j-r428

Metricbeat affected by multiple denial of service vulnerabilities

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-0528

Packages

EcosystemPackageAffectedFixed in
Go github.com/elastic/beats/v7 < 7.0.0-alpha2.0.20251217054608-6e42552a23ce 7.0.0-alpha2.0.20251217054608-6e42552a23ce
Go github.com/elastic/beats/v7 >= 8.0.0, < 8.19.10 8.19.10
Go github.com/elastic/beats/v7 >= 9.0.0, < 9.1.10 9.1.10
Go github.com/elastic/beats/v7 >= 9.2.0, < 9.2.4 9.2.4

Details

As written in the advisory (Markdown source, shown as plain text).

Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input Validation (CWE-20) exists in the Prometheus helper module that can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed metric data.

References

External links from the advisory. They lead to third-party sites.