Packetbeat 8.19.10, 9.1.10, 9.2.4 Security Update (ESA-2026-02)

Announcements Security Announcements
1

Improper Validation of Array Index in Packetbeat Leading to Overflow Buffers (ESA-2026-02)

Improper Validation of Array Index (CWE-129) in Packetbeat’s MongoDB protocol parser can allow an attacker to cause Overflow Buffers (CAPEC-100) through specially crafted network traffic. This requires an attacker to send a malformed payload to a monitored network interface where MongoDB protocol parsing is enabled.

Affected Versions:

  • 7.x: All versions
  • 8.x: All versions from 8.0.0 up to and including 8.19.9
  • 9.x:
    • All versions from 9.0.0 up to and including 9.1.9
    • All versions from 9.2.0 up to and including 9.2.3

Solutions and Mitigations:

The issue is resolved in version 8.19.10, 9.1.10, 9.2.4.

For Users that Cannot Upgrade:

There are no workarounds

Acknowledgements:

We would like to thank AISLE Research for responsibly disclosing this vulnerability to Elastic

Severity: CVSSv3.1: Medium (6.5) - AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE ID: CVE-2026-0529

Problem Type: CWE-129 - Improper Validation of Array Index

Impact: CAPEC-100 - Overflow Buffers