Skip to content
Sign in
6.5 Medium

CVE-2026-0528 Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service…

Description

Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input Validation (CWE-20) exists in the Prometheus helper module that can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed metric data.

Affected products and versions

Product Affected versions Fixed in
Metricbeat 9.2 9.2.0 → 9.2.3 No fix stated
Metricbeat 9.0 9.0.0 → 9.1.9 No fix stated
Metricbeat 8.0 8.0.0 → 8.19.9 No fix stated
Metricbeat 7.0 7.0.0 → 7.17.29 No fix stated

Other CVEs of Metricbeat

The 2 CVEs of Metricbeat →
CVE-2026-26931 Memory Allocation with Excessive Size Value (CWE-789) in the Prometheus remote_write HTTP handler in Metricbeat can lead… 5.7 Medium
Track this CVE