Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/elastic/beats/v7 < 7.0.0-alpha2.0.20260126223743-dec1b31111ec
Fixed in
7.0.0-alpha2.0.20260126223743-dec1b31111ec· Vendor fix available
Issue
Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker with the ability to send specially crafted, malformed network packets to a monitored network interface can trigger out-of-bounds read operations, resulting in application crashes or resource exhaustion. This requires the attacker to be positioned on the same network segment as the Packetbeat deployment or to control traffic routed to monitored interfaces.
Recommended action: Upgrade to 7.0.0-alpha2.0.20260126223743-dec1b31111ec (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/elastic/beats/v7 < 7.0.0-alpha2.0.20260112100137-de072c4e371e
Fixed in
7.0.0-alpha2.0.20260112100137-de072c4e371e· Vendor fix available
Issue
Memory Allocation with Excessive Size Value (CWE-789) in the Prometheus remotewrite HTTP handler in Metricbeat can lead Denial of Service via Excessive Allocation (CAPEC-130).
Recommended action: Upgrade to 7.0.0-alpha2.0.20260112100137-de072c4e371e (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
8.19.109.1.107.0.0-alpha2.0.20251217054608-6e42552a23ce9.2.4· Vendor fix available
Issue
Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input Validation (CWE-20) exists in the Prometheus helper module that can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed metric data.
Recommended action: Upgrade to 9.2.4, 9.1.10, 8.19.10 or 7.0.0-alpha2.0.20251217054608-6e42552a23ce (pre-release) by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/elastic/beats/v7 < 7.0.0-alpha2.0.20251209162832-28cfc80d2f4e
Fixed in
7.0.0-alpha2.0.20251209162832-28cfc80d2f4e· Vendor fix available
Issue
Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC-130) of memory and CPU via the integration of malicious IPv4 fragments, leading to denial-of-service in Packetbeat.
Recommended action: Upgrade to 7.0.0-alpha2.0.20251209162832-28cfc80d2f4e (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/elastic/beats/v7 >= 7.0.0, < 7.17.16
Fixed in
7.17.16· Vendor fix available
Issue
An issue was discovered by Elastic whereby Beats and Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending on the nature of the event that Beats or Elastic Agent attempted to ingest, this could lead to the insertion of sensitive or private information in the Beats or Elastic Agent logs. Elastic has released 8.11.3 and 7.17.16 that prevents this issue by limiting these types of logs to DEBUG level logging, which is disabled by default.
Recommended action: Upgrade to 7.17.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.