Cloudanix VulnDB

CVE-2026-0528

Medium · 6.5

Metricbeat affected by multiple denial of service vulnerabilities

CVSS

6.5

EPSS

0.4%

Published

Jan 13, 2026

CISA due date

—

The record

Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input Validation (CWE-20) exists in the Prometheus helper module that can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed metric data.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/elastic/beats/v7 0 7.0.0-alpha2.0.20251217054608-6e42552a23ce
Go github.com/elastic/beats/v7 8.0.0 8.19.10
Go github.com/elastic/beats/v7 9.0.0 9.1.10
Go github.com/elastic/beats/v7 9.2.0 9.2.4
Chainguard apm-server-8.19 0 8.19.11-r0
Chainguard apm-server-9.2 0 9.2.4-r0
Chainguard apm-server-fips-8.19 0 8.19.11-r0
go github.com/elastic/beats/v7 8.0.0 8.19.10
go github.com/elastic/beats/v7 9.0.0 9.1.10
go github.com/elastic/beats/v7 9.2.0 9.2.4
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20260317T205859-150000.1.152.1

Related vulnerabilities