CVE-2026-26932 MEDIUM

CVE-2026-26932: Improper Validation of Array Index in Packetbeat Leading to Denial of Service

Vendor Elastic
Product Packetbeat
Weakness CWE-129
Published February 26, 2026
Last update February 26, 2026
View on NVD All CVEs

CVSS base score

5.7/10
Attack vector Adjacent
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted packet causing a Go runtime panic that terminates the Packetbeat process. This vulnerability requires the pgsql protocol to be explicitly enabled and configured to monitor traffic on the targeted port.

Key dates

02Disclosure timeline

February 26, 2026 CVE published
February 26, 2026 Record updated