CVE-2026-26932: Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial o

Routine

MEDIUM 5.7UPGRADE

CVE-2026-26932 is a medium-severity flaw (CVSS 5.7) affecting packetbeat. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted packet causing a Go runtime panic that terminates the Packetbeat process. This vulnerability requires the pgsql protocol to be explicitly enabled and configured to monitor traffic on the targeted port.

Why this priority

No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score	5.7 (Medium)
Attack vector	Adjacent network
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	0.5% (top 57%)
CISA exploited list	No
Weakness	CWE-129
Published	2026-02-26
Last modified	2026-06-17

Publisher (CNA): Elastic · Vendor: elasticsearch

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-02-26 18:23 UTCPublished CVE record published
2026-06-17 10:26 UTCUpdated Record last modified

elasticsearch packetbeat UPGRADE

Affected: >= 8.0.0 and < 8.19.11 · >= 9.0.0 and < 9.2.5

Fixed in: 8.19.11, 9.2.5

Safe to downgrade to: a release before 8.0.0

1. Check installed version

apt-cache policy packetbeat || rpm -q packetbeat || packetbeat --version

2. UPGRADE to 8.19.11 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade packetbeat

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade packetbeat

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 8.0.0 (Debian / Ubuntu)

apt-cache madison packetbeat sudo apt install packetbeat=<VERSION_BEFORE_8.0.0> sudo apt-mark hold packetbeat

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list packetbeat sudo dnf downgrade packetbeat-<VERSION_BEFORE_8.0.0> sudo dnf versionlock add packetbeat

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-26932?

packetbeat: upgrade to 8.19.11, 9.2.5. Exact commands for each OS are on this page.

Is CVE-2026-26932 being exploited?

CVE-2026-26932 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-26932 affect?

CVE-2026-26932 affects packetbeat. Severity is medium (CVSS 5.7). Improper Validation of Array Index (CWE-129) in the PostgreSQL protocol parser in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted packet causing a Go runtime panic that

How urgent is CVE-2026-26932?

Priority 31/100. No elevated risk signals yet.

Software pages

Elasticsearch vulnerabilities · PostgreSQL vulnerabilities

Related CVEs

CVE-2026-26933 MEDIUM 5.7 UPGRADE Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Den
CVE-2025-68388 MEDIUM 5.3 UPGRADE Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to ca
CVE-2025-68382 MEDIUM 6.5 UPGRADE Out-of-bounds read (CWE-125) allows an unauthenticated remote attacker to perform a buffer overflow (CAPEC-100
CVE-2025-68381 MEDIUM 6.5 UPGRADE Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer

References

← Back to latest CVEs