CVE-2026-26932: Elasticsearch Packetbeat

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted packet causing a Go runtime panic that terminates the Packetbeat process. This vulnerability requires the pgsql protocol to be explicitly enabled and configured to monitor traffic on the targeted port.

Affected products

• Elasticsearch Packetbeat: from 8.0.0, before 8.19.11 (fixed in 8.19.11); from 9.0.0, before 9.2.5 (fixed in 9.2.5)

Published 2026-02-26. Last modified 2026-06-17.