Packetbeat 9.3.0 crashes with Go panic in DHCPv4 parser (makeslice: cap out of range) on Ubuntu 24
Environment
• OS: Ubuntu Server 24.04 LTS (amd64)
• Packetbeat version: packetbeat version 9.3.0 (amd64) libbeat 9.3.0 commit: 0f4fc63162db855e0a1c5f0ec5894a8939e31d80 build date: 2026-01-29 07:16:35 UTC IPS distribution: false
Packetbeat frequently crashes and is restarted by systemd. The crash is caused by a Go runtime panic in the DHCPv4 protocol parser while processing UDP traffic. The panic happens repeatedly within seconds after restart, leading to a restart loop.
root@xyz:/home/user# journalctl --since "2026-02-03 14:40:00" --until "2026-02-03 14:45:05" -u packetbeat
Feb 03 14:44:15 xyz.host packetbeat[1616490]: panic: runtime error: makeslice: cap out of range
Feb 03 14:44:15 xyz.host packetbeat[1616490]: goroutine 228 [running]:
Feb 03 14:44:15 xyz.host packetbeat[1616490]: github.com/elastic/beats/v7/packetbeat/protos/dhcpv4.formatHardwareAddr(...)
Feb 03 14:44:15 xyz.host packetbeat[1616490]: github.com/elastic/beats/v7/packetbeat/protos/dhcpv4/dhcpv4.go:174
Feb 03 14:44:15 xyz.host packetbeat[1616490]: github.com/elastic/beats/v7/packetbeat/protos/dhcpv4.(*dhcpv4Plugin).parseDHCPv4(0xc000b2c4c0, 0xc009307680)
Feb 03 14:44:15 xyz.host packetbeat[1616490]: github.com/elastic/beats/v7/packetbeat/protos/dhcpv4/dhcpv4.go:139 +0xd50
Feb 03 14:44:15 xyz.host packetbeat[1616490]: github.com/elastic/beats/v7/packetbeat/protos/dhcpv4.(*dhcpv4Plugin).ParseUDP(0xc000b2c4c0, 0x3?)
Feb 03 14:44:15 xyz.host packetbeat[1616490]: github.com/elastic/beats/v7/packetbeat/protos/dhcpv4/dhcpv4.go:88 +0x25
Feb 03 14:44:15 xyz.host packetbeat[1616490]: github.com/elastic/beats/v7/packetbeat/protos/udp.(*UDP).Process(0xc0004e20e0, 0xc000430044?, 0xc009307680)
Feb 03 14:44:15 xyz.host packetbeat[1616490]: github.com/elastic/beats/v7/packetbeat/protos/udp/udp.go:110 +0x16d
Feb 03 14:44:15 xyz.host packetbeat[1616490]: github.com/elastic/beats/v7/packetbeat/decoder.(*Decoder).onUDP(0xc000467208, 0xc009307680)
Feb 03 14:44:15 xyz.host packetbeat[1616490]: github.com/elastic/beats/v7/packetbeat/decoder/decoder.go:510 +0xeb
Feb 03 14:44:15 xyz.host packetbeat[1616490]: github.com/elastic/beats/v7/packetbeat/decoder.(*Decoder).process(0xc000467208, 0xc009307680, 0x134?)
Feb 03 14:44:15 xyz.host packetbeat[1616490]: github.com/elastic/beats/v7/packetbeat/decoder/decoder.go:453 +0x1ed
Feb 03 14:44:15 xyz.host packetbeat[1616490]: github.com/elastic/beats/v7/packetbeat/decoder.(*Decoder).OnPacket(0xc000467208, {0xc00035ef20, 0x158, 0x158}, 0xc0083c5d20)
Feb 03 14:44:15 xyz.host packetbeat[1616490]: github.com/elastic/beats/v7/packetbeat/decoder/decoder.go:240 +0x36e
Feb 03 14:44:15 xyz.host packetbeat[1616490]: github.com/elastic/beats/v7/packetbeat/sniffer.(*sniffer).sniffHandle(0xc000233320, {0x58ad93156ac8, 0xc000412e60}, {0x58ad9313cb48, 0xc000595800}, 0xc000467208, 0x0)
Feb 03 14:44:15 xyz.host packetbeat[1616490]: github.com/elastic/beats/v7/packetbeat/sniffer/sniffer.go:467 +0x9c7
Feb 03 14:44:15 xyz.host packetbeat[1616490]: github.com/elastic/beats/v7/packetbeat/sniffer.(*sniffer).sniffStatic(0xc000233320, {0x58ad93156ac8, 0xc000412e60}, {0xc00040fe58, 0x3})
Feb 03 14:44:15 xyz.host packetbeat[1616490]: github.com/elastic/beats/v7/packetbeat/sniffer/sniffer.go:310 +0x17b
Feb 03 14:44:15 xyz.host packetbeat[1616490]: github.com/elastic/beats/v7/packetbeat/sniffer.(*Sniffer).Run.func1()
Feb 03 14:44:15 xyz.host packetbeat[1616490]: github.com/elastic/beats/v7/packetbeat/sniffer/sniffer.go:228 +0x145
Feb 03 14:44:15 xyz.host packetbeat[1616490]: golang.org/x/sync/errgroup.(*Group).Go.func1()
Feb 03 14:44:15 xyz.host packetbeat[1616490]: golang.org/x/sync@v0.18.0/errgroup/errgroup.go:93 +0x50
Feb 03 14:44:15 xyz.host packetbeat[1616490]: created by golang.org/x/sync/errgroup.(*Group).Go in goroutine 227
Feb 03 14:44:15 xyz.host packetbeat[1616490]: golang.org/x/sync@v0.18.0/errgroup/errgroup.go:78 +0x93
Feb 03 14:44:15 xyz.host systemd[1]: packetbeat.service: Main process exited, code=exited, status=2/INVALIDARGUMENT
Feb 03 14:44:15 xyz.host systemd[1]: packetbeat.service: Failed with result 'exit-code'.
Feb 03 14:44:15 xyz.host systemd[1]: packetbeat.service: Consumed 40min 34.888s CPU time, 109.5M memory peak, 0B memory swap peak.
Feb 03 14:44:15 xyz.host systemd[1]: packetbeat.service: Scheduled restart job, restart counter is at 1.
Feb 03 14:44:15 xyz.host systemd[1]: Started packetbeat.service - Packetbeat analyzes network traffic and sends the data to Elasticsearch..
Feb 03 14:44:20 xyz.host packetbeat[1692344]: panic: runtime error: makeslice: cap out of range
Feb 03 14:44:20 xyz.host packetbeat[1692344]: goroutine 227 [running]:
Feb 03 14:44:20 xyz.host packetbeat[1692344]: github.com/elastic/beats/v7/packetbeat/protos/dhcpv4.formatHardwareAddr(...)
Feb 03 14:44:20 xyz.host packetbeat[1692344]: github.com/elastic/beats/v7/packetbeat/protos/dhcpv4/dhcpv4.go:174
Feb 03 14:44:20 xyz.host packetbeat[1692344]: github.com/elastic/beats/v7/packetbeat/protos/dhcpv4.(*dhcpv4Plugin).parseDHCPv4(0xc000115e00, 0xc005362900)
Feb 03 14:44:20 xyz.host packetbeat[1692344]: github.com/elastic/beats/v7/packetbeat/protos/dhcpv4/dhcpv4.go:139 +0xd50
Feb 03 14:44:20 xyz.host packetbeat[1692344]: github.com/elastic/beats/v7/packetbeat/protos/dhcpv4.(*dhcpv4Plugin).ParseUDP(0xc000115e00, 0x3?)
Feb 03 14:44:20 xyz.host packetbeat[1692344]: github.com/elastic/beats/v7/packetbeat/protos/dhcpv4/dhcpv4.go:88 +0x25
Feb 03 14:44:20 xyz.host packetbeat[1692344]: github.com/elastic/beats/v7/packetbeat/protos/udp.(*UDP).Process(0xc000465960, 0xc000430044?, 0xc005362900)
Feb 03 14:44:20 xyz.host packetbeat[1692344]: github.com/elastic/beats/v7/packetbeat/protos/udp/udp.go:110 +0x16d
Feb 03 14:44:20 xyz.host packetbeat[1692344]: github.com/elastic/beats/v7/packetbeat/decoder.(*Decoder).onUDP(0xc0006cf208, 0xc005362900)
Feb 03 14:44:20 xyz.host packetbeat[1692344]: github.com/elastic/beats/v7/packetbeat/decoder/decoder.go:510 +0xeb
Feb 03 14:44:20 xyz.host packetbeat[1692344]: github.com/elastic/beats/v7/packetbeat/decoder.(*Decoder).process(0xc0006cf208, 0xc005362900, 0x134?)
Feb 03 14:44:20 xyz.host packetbeat[1692344]: github.com/elastic/beats/v7/packetbeat/decoder/decoder.go:453 +0x1ed
Feb 03 14:44:20 xyz.host packetbeat[1692344]: github.com/elastic/beats/v7/packetbeat/decoder.(*Decoder).OnPacket(0xc0006cf208, {0xc000380420, 0x158, 0x158}, 0xc00536dd20)
Feb 03 14:44:20 xyz.host packetbeat[1692344]: github.com/elastic/beats/v7/packetbeat/decoder/decoder.go:240 +0x36e
Feb 03 14:44:20 xyz.host packetbeat[1692344]: github.com/elastic/beats/v7/packetbeat/sniffer.(*sniffer).sniffHandle(0xc00045f9e0, {0x612ea82a3ac8, 0xc000a971d0}, {0x612ea8289b48, 0xc000c9d500}, 0xc0006cf208, 0x0)
Feb 03 14:44:20 xyz.host packetbeat[1692344]: github.com/elastic/beats/v7/packetbeat/sniffer/sniffer.go:467 +0x9c7
Feb 03 14:44:20 xyz.host packetbeat[1692344]: github.com/elastic/beats/v7/packetbeat/sniffer.(*sniffer).sniffStatic(0xc00045f9e0, {0x612ea82a3ac8, 0xc000a971d0}, {0xc00019f918, 0x3})
Feb 03 14:44:20 xyz.host packetbeat[1692344]: github.com/elastic/beats/v7/packetbeat/sniffer/sniffer.go:310 +0x17b
Feb 03 14:44:20 xyz.host packetbeat[1692344]: github.com/elastic/beats/v7/packetbeat/sniffer.(*Sniffer).Run.func1()
Feb 03 14:44:20 xyz.host packetbeat[1692344]: github.com/elastic/beats/v7/packetbeat/sniffer/sniffer.go:228 +0x145
Feb 03 14:44:20 xyz.host packetbeat[1692344]: golang.org/x/sync/errgroup.(*Group).Go.func1()
Feb 03 14:44:20 xyz.host packetbeat[1692344]: golang.org/x/sync@v0.18.0/errgroup/errgroup.go:93 +0x50
Feb 03 14:44:20 xyz.host packetbeat[1692344]: created by golang.org/x/sync/errgroup.(*Group).Go in goroutine 226
Feb 03 14:44:20 xyz.host packetbeat[1692344]: golang.org/x/sync@v0.18.0/errgroup/errgroup.go:78 +0x93
Feb 03 14:44:20 xyz.host systemd[1]: packetbeat.service: Main process exited, code=exited, status=2/INVALIDARGUMENT
Feb 03 14:44:20 xyz.host systemd[1]: packetbeat.service: Failed with result 'exit-code'.
Feb 03 14:44:20 xyz.host systemd[1]: packetbeat.service: Scheduled restart job, restart counter is at 2.
Feb 03 14:44:20 xyz.host systemd[1]: Started packetbeat.service - Packetbeat analyzes network traffic and sends the data to Elasticsearch..
The same panic occurs again immediately after restart.