{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-02T08:30:29.226","vulnerabilities":[{"cve":{"id":"CVE-2026-26933","sourceIdentifier":"security@elastic.co","published":"2026-03-19T18:16:21.497","lastModified":"2026-06-17T10:26:24.710","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Validation of Array Index (CWE-129) in multiple protocol parser components in Packetbeat can lead Denial of Service via Input Data Manipulation (CAPEC-153). An attacker with the ability to send specially crafted, malformed network packets to a monitored network interface can trigger out-of-bounds read operations, resulting in application crashes or resource exhaustion. This requires the attacker to be positioned on the same network segment as the Packetbeat deployment or to control traffic routed to monitored interfaces."},{"lang":"es","value":"Validación Incorrecta de Índice de Array (CWE-129) en múltiples componentes analizadores de protocolo en Packetbeat puede provocar denegación de servicio a través de Manipulación de Datos de Entrada (CAPEC-153). Un atacante con la capacidad de enviar paquetes de red malformados y especialmente diseñados a una interfaz de red monitoreada puede desencadenar operaciones de lectura fuera de límites, lo que resulta en caídas de la aplicación o agotamiento de recursos. Esto requiere que el atacante esté posicionado en el mismo segmento de red que la implementación de Packetbeat o que controle el tráfico enrutado a las interfaces monitoreadas."}],"affected":[{"source":"security@elastic.co","affectedData":[{"vendor":"Elastic","product":"Packetbeat","defaultStatus":"unaffected","versions":[{"version":"9.0.0","lessThanOrEqual":"9.2.4","versionType":"semver","status":"affected"},{"version":"8.0.0","lessThanOrEqual":"8.19.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@elastic.co","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.7,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-19T17:52:18.932207Z","id":"CVE-2026-26933","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@elastic.co","type":"Secondary","description":[{"lang":"en","value":"CWE-129"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:elasticsearch:packetbeat:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.19.11","matchCriteriaId":"5B3AF1B0-F18A-41C2-B4AC-0156C95D7153"},{"vulnerable":true,"criteria":"cpe:2.3:a:elasticsearch:packetbeat:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.2.5","matchCriteriaId":"4936046E-0E8D-4A75-8FD4-F4266B47A8FE"}]}]}],"references":[{"url":"https://discuss.elastic.co/t/packetbeat-8-19-11-9-2-5-security-update-esa-2026-11/385533","source":"security@elastic.co","tags":["Vendor Advisory"]}]}}]}