GHSA-w2gr-585j-r428
Medium · 6.5CVSS
6.5
EPSS
—
Published
Jan 13, 2026
CISA due date
—
The record
Metricbeat affected by multiple denial of service vulnerabilities
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/elastic/beats/v7 | 0 | 7.0.0-alpha2.0.20251217054608-6e42552a23ce |
| Go | github.com/elastic/beats/v7 | 8.0.0 | 8.19.10 |
| Go | github.com/elastic/beats/v7 | 9.0.0 | 9.1.10 |
| Go | github.com/elastic/beats/v7 | 9.2.0 | 9.2.4 |
| Chainguard | apm-server-8.19 | 0 | 8.19.11-r0 |
| Chainguard | apm-server-9.2 | 0 | 9.2.4-r0 |
| Chainguard | apm-server-fips-8.19 | 0 | 8.19.11-r0 |
| go | github.com/elastic/beats/v7 | 8.0.0 | 8.19.10 |
| go | github.com/elastic/beats/v7 | 9.0.0 | 9.1.10 |
| go | github.com/elastic/beats/v7 | 9.2.0 | 9.2.4 |
Related vulnerabilities
- CVE-2026-0528 Metricbeat affected by multiple denial of service vulnerabilities Same vulnerability
- GO-2025-4253 Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4… Also affects github.com/elastic/beats/v7
- CVE-2025-68388 Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4… Also affects github.com/elastic/beats/v7
- CVE-2025-68383 Filebeat Beats has Buffer Overflow via Malformed Syslog Message or Malicious Tokenizer… Also affects github.com/elastic/beats/v7
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects apm-server-8.19
- CVE-2026-27142 Actions which insert URLs into the content attribute of HTML meta tags are not escaped. Also affects apm-server-8.19
- CVE-2026-27139 On Unix platforms, when listing the contents of a directory using File.ReadDir or… Also affects apm-server-8.19
- CVE-2026-25679 url.Parse insufficiently validated the host/authority component and accepted some invalid… Also affects apm-server-8.19