Read the docs
TI-2025-41959 Aliases CVE-2025-68383GHSA-2mj3-6grc-px38

Filebeat Improper Validation of Specified Index, Position, or Offset in Input

Priority LOW 28CWE-1284Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-120 and the CVSS impact.

Summary

Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbeat Dissect processor can allow a user to trigger a Buffer Overflow (CAPEC-100) and cause a denial of service (panic/crash) of the Filebeat process via either a malformed Syslog message or a malicious tokenizer pattern in the Dissect configuration.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00191 8th percentileScored 2026-11-07
Fix Fixed github.com/elastic/beats/v7 (Go): 8.19.9, 9.1.9, 9.2.3 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ElasticFilebeat7.0.0 – 7.17.29; 8.0.0 – 8.19.8; 9.0.0 – 9.1.8; 9.2.0 – 9.2.2—No fix listedCNA
—github.com/elastic/beats/v7 (Go)7.7.0 to before 8.19.98.19.9Patch availableGHSA-2mj3-6grc-px38
—github.com/elastic/beats/v7 (Go)9.0.0 to before 9.1.99.1.9Patch availableGHSA-2mj3-6grc-px38
—github.com/elastic/beats/v7 (Go)9.2.0 to before 9.2.39.2.3Patch availableGHSA-2mj3-6grc-px38
—github.com/elastic/beats/v7 (Go)before 7.0.0-alpha2.0.20251204214633-dd3af18220bf7.0.0-alpha2.0.20251204214633-dd3af18220bfPatch availableGHSA-2mj3-6grc-px38
—github.com/elastic/beats (Go)up to 7.6.2—No fix listedGHSA-2mj3-6grc-px38
  • Filebeat VendorElastic Affected 7.0.0 – 7.17.29; 8.0.0 – 8.19.8; 9.0.0 – 9.1.8; 9.2.0 – 9.2.2 Fixed in — No fix listed CNA
  • github.com/elastic/beats/v7 (Go) Vendor— Affected 7.7.0 to before 8.19.9 Fixed in 8.19.9 Patch available GHSA-2mj3-6grc-px38
  • github.com/elastic/beats/v7 (Go) Vendor— Affected 9.0.0 to before 9.1.9 Fixed in 9.1.9 Patch available GHSA-2mj3-6grc-px38
  • github.com/elastic/beats/v7 (Go) Vendor— Affected 9.2.0 to before 9.2.3 Fixed in 9.2.3 Patch available GHSA-2mj3-6grc-px38
  • github.com/elastic/beats/v7 (Go) Vendor— Affected before 7.0.0-alpha2.0.20251204214633-dd3af18220bf Fixed in 7.0.0-alpha2.0.20251204214633-dd3af18220bf Patch available GHSA-2mj3-6grc-px38
  • github.com/elastic/beats (Go) Vendor— Affected up to 7.6.2 Fixed in — No fix listed GHSA-2mj3-6grc-px38

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:elastic:filebeat:*:*:*:*:*:*:*:*7.0.0 – 7.17.29; 8.0.0 to before 8.19.9; 9.0.0 to before 9.1.9; 9.2.0 to before 9.2.3VulnerableElastic
  • cpe:2.3:a:elastic:filebeat:*:*:*:*:*:*:*:* Versions 7.0.0 – 7.17.29; 8.0.0 to before 8.19.9; 9.0.0 to before 9.1.9; 9.2.0 to before 9.2.3 Vulnerable ·Elastic

Remediation

  • Fix · GHSA-2mj3-6grc-px38 github.com/elastic/beats/v7 (Go) Fixed in 8.19.9 Advisory →
  • Fix · GHSA-2mj3-6grc-px38 github.com/elastic/beats/v7 (Go) Fixed in 9.1.9 Advisory →
  • Fix · GHSA-2mj3-6grc-px38 github.com/elastic/beats/v7 (Go) Fixed in 9.2.3 Advisory →
  • Fix · GHSA-2mj3-6grc-px38 github.com/elastic/beats/v7 (Go) Fixed in 7.0.0-alpha2.0.20251204214633-dd3af18220bf Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-68383
  2. 2026-10-03 Alias added: GHSA-2mj3-6grc-px38

References

Advisory 2

Other 4

  • TI-2026-54638 Allocation of Resources Without Limits or Throttling in Filebeat Leading to Denial of Service CVSS 3.1MEDIUM 6.5
  • TI-2023-15031 Information disclosure in Elastic Filebeat CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences