PT-2026-22162 · Elastic · Packetbeat

Giant_Anteater · Published 2026-02-26 · Updated 2026-03-13 · CVE-2026-26932

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Packetbeat (affected versions not specified)

Description A flaw exists in the PostgreSQL protocol parser within Packetbeat that allows for Denial of Service through manipulation of input data. Specifically, improper validation of an array index can cause a Go runtime panic, leading to the termination of the Packetbeat process. This requires the pgsql protocol to be explicitly enabled and configured to monitor traffic on the targeted port.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2026-26932

Affected Products

Packetbeat

References · 6

• https://discuss.elastic.co/t/packetbeat-8-19-11-9-2-5-security-update-esa-2026-10/385247 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26932 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26932 · Security Note
• https://twitter.com/CVEnew/status/2027099249062854974 · Twitter Post
• https://twitter.com/dailycve/status/2032273415441195185 · Twitter Post
• https://t.me/cveNotify/155351 · Telegram Post