CVE-2026-26932

Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted packet causing a Go runtime panic that terminates the Packetbeat process. This vulnerability requires the pgsql protocol to be explicitly enabled and configured to monitor traffic on the targeted port.

CVSS v3 5.7 MEDIUM

5.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://discuss.elastic.co/t/packetbeat-8-19-11-9-2-5-security-update-esa-2026-10/385247	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:elasticsearch:packetbeat::::::::
	cpe:2.3:a:elasticsearch:packetbeat::::::::

History

12 Mar 2026, 20:23

Type	Values Removed	Values Added
CPE		cpe:2.3:a:elasticsearch:packetbeat::::::::
References	~~() https://discuss.elastic.co/t/packetbeat-8-19-11-9-2-5-security-update-esa-2026-10/385247 -~~	() https://discuss.elastic.co/t/packetbeat-8-19-11-9-2-5-security-update-esa-2026-10/385247 - Vendor Advisory
First Time		Elasticsearch packetbeat Elasticsearch
Summary		(es) Validación incorrecta de índice de array (CWE-129) en el analizador del protocolo PostgreSQL en Packetbeat puede conducir a denegación de servicio a través de manipulación de datos de entrada (CAPEC-153). Un atacante puede enviar un paquete especialmente diseñado causando un pánico en tiempo de ejecución de Go que termina el proceso de Packetbeat. Esta vulnerabilidad requiere que el protocolo pgsql esté explícitamente habilitado y configurado para monitorear el tráfico en el puerto objetivo.

26 Feb 2026, 18:23

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-26 18:23

Updated : 2026-03-12 20:23

NVD link : CVE-2026-26932

Mitre link : CVE-2026-26932

CVE.ORG link : CVE-2026-26932

JSON object : View

Products Affected

elasticsearch

packetbeat

CWE

CWE-129

Improper Validation of Array Index

{"id": "CVE-2026-26932", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@elastic.co", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2026-02-26T18:23:07.470", "references": [{"url": "https://discuss.elastic.co/t/packetbeat-8-19-11-9-2-5-security-update-esa-2026-10/385247", "tags": ["Vendor Advisory"], "source": "security@elastic.co"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@elastic.co", "description": [{"lang": "en", "value": "CWE-129"}]}], "descriptions": [{"lang": "en", "value": "Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted packet causing a Go runtime panic that terminates the Packetbeat process. This vulnerability requires the pgsql protocol to be explicitly enabled and configured to monitor traffic on the targeted port."}, {"lang": "es", "value": "Validaci\u00f3n incorrecta de \u00edndice de array (CWE-129) en el analizador del protocolo PostgreSQL en Packetbeat puede conducir a denegaci\u00f3n de servicio a trav\u00e9s de manipulaci\u00f3n de datos de entrada (CAPEC-153). Un atacante puede enviar un paquete especialmente dise\u00f1ado causando un p\u00e1nico en tiempo de ejecuci\u00f3n de Go que termina el proceso de Packetbeat. Esta vulnerabilidad requiere que el protocolo pgsql est\u00e9 expl\u00edcitamente habilitado y configurado para monitorear el tr\u00e1fico en el puerto objetivo."}], "lastModified": "2026-03-12T20:23:24.030", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elasticsearch:packetbeat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5B3AF1B0-F18A-41C2-B4AC-0156C95D7153", "versionEndExcluding": "8.19.11", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:elasticsearch:packetbeat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4936046E-0E8D-4A75-8FD4-F4266B47A8FE", "versionEndExcluding": "9.2.5", "versionStartIncluding": "9.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@elastic.co"}