# Filebeat 9.5.3 built with Go 1.26.7 is reported as containing vulnerable Go stdlib 1.19.9 and golang\_org/x/net 0.7.0

**URL:** <https://discuss.elastic.co/t/filebeat-9-5-3-built-with-go-1-26-7-is-reported-as-containing-vulnerable-go-stdlib-1-19-9-and-golang-org-x-net-0-7-0/391053>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 19, 2026, 7:20am UTC](https://discuss.elastic.co/t/filebeat-9-5-3-built-with-go-1-26-7-is-reported-as-containing-vulnerable-go-stdlib-1-19-9-and-golang-org-x-net-0-7-0/391053 "2026-10-19T07:20:16Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sam2nd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sam2nd/32/148412_2.png) [@Sam2nd](https://discuss.elastic.co/u/Sam2nd)\
**Post date:** [October 19, 2026, 7:20am UTC](https://discuss.elastic.co/t/filebeat-9-5-3-built-with-go-1-26-7-is-reported-as-containing-vulnerable-go-stdlib-1-19-9-and-golang-org-x-net-0-7-0/391053/1 "2026-10-19T07:20:16Z")

</div>

Hi Team,

Our vulnerability scanner reports multiple CVEs against the Filebeat 9.5.3 binary, including:

- CVE-2023-45288
- CVE-2023-39325
- CVE-2026-39821
- CVE-2026-33814
- CVE-2026-46600

**The scanner identifies the following dependencies within:**

/usr/share/filebeat/filebeat

- stdlib-1.19.9
- golang\_org/x/net 0.7.0

**Suggested patched versions reported by the scanner:**

- Go stdlib: 1.25.1, 1.26.3
- golang\_org/x/net: 0.56.0

**However, Filebeat reports that it was built with:**

- Filebeat 9.5.3
- Go 1.26.7

Since Go 1.26.7 is newer than the patched versions referenced by the vulnerability advisories, the findings appear inconsistent with the build information and may be false positives related to dependency detection in statically linked Go binaries. CVE-2026-46600, for example, is documented as fixed in Go 1.26.3+ and \<golang\_org/x/net\> 0.56.0+.

**Could you please confirm:**

1. Whether these dependency versions are actually present in Filebeat 9.5.3.

2. Whether these findings are known false positives.

3. Whether Elastic provides an SBOM or dependency manifest that can be used to validate the actual embedded dependency versions.

4. Whether a newer Filebeat release is required to address these CVEs.

5. If remediation is required, which Filebeat version contains the corresponding fixes.

Thank you.