TI-2025-41964 Aliases CVE-2025-68388 GHSA-fj69-23m4-ccvv

Resource allocation without limits in Elastic Packetbeat

LOW 30CWE-770Published 2025-12-18 · Updated 2025-12-19

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC-130) of memory and CPU via the integration of malicious IPv4 fragments, leading to a degradation in Packetbeat.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00412 35th percentileScored 2026-11-07

Fix Fixed github.com/elastic/beats (Go): 8.19.9, 9.1.9, 9.2.3github.com/elastic/beats/v7 (Go): 7.0.0-alpha2.0.20251209162832-28cfc80d2f4e

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Elastic	Packetbeat	8.6.0 – 8.19.8; 9.0.0 – 9.1.8; 9.2.0 – 9.2.2	—	No fix listed	CNA
—	github.com/elastic/beats (Go)	8.6.0 to before 8.19.9	8.19.9	Patch available	GHSA-fj69-23m4-ccvv
—	github.com/elastic/beats (Go)	9.0.0 to before 9.1.9	9.1.9	Patch available	GHSA-fj69-23m4-ccvv
—	github.com/elastic/beats (Go)	9.2.0 to before 9.2.3	9.2.3	Patch available	GHSA-fj69-23m4-ccvv
—	github.com/elastic/beats/v7 (Go)	before 7.0.0-alpha2.0.20251209162832-28cfc80d2f4e	7.0.0-alpha2.0.20251209162832-28cfc80d2f4e	Patch available	GHSA-fj69-23m4-ccvv

Packetbeat VendorElastic Affected 8.6.0 – 8.19.8; 9.0.0 – 9.1.8; 9.2.0 – 9.2.2 Fixed in — No fix listed CNA
github.com/elastic/beats (Go) Vendor— Affected 8.6.0 to before 8.19.9 Fixed in 8.19.9 Patch available GHSA-fj69-23m4-ccvv
github.com/elastic/beats (Go) Vendor— Affected 9.0.0 to before 9.1.9 Fixed in 9.1.9 Patch available GHSA-fj69-23m4-ccvv
github.com/elastic/beats (Go) Vendor— Affected 9.2.0 to before 9.2.3 Fixed in 9.2.3 Patch available GHSA-fj69-23m4-ccvv
github.com/elastic/beats/v7 (Go) Vendor— Affected before 7.0.0-alpha2.0.20251209162832-28cfc80d2f4e Fixed in 7.0.0-alpha2.0.20251209162832-28cfc80d2f4e Patch available GHSA-fj69-23m4-ccvv

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:elasticsearch:packetbeat::::::::	8.6.0 to before 8.19.9; 9.0.0 to before 9.1.9; 9.2.0 to before 9.2.3	Vulnerable	Elasticsearch

cpe:2.3:a:elasticsearch:packetbeat:*:*:*:*:*:*:*:* Versions 8.6.0 to before 8.19.9; 9.0.0 to before 9.1.9; 9.2.0 to before 9.2.3 Vulnerable ·Elasticsearch

Remediation

Fix · GHSA-fj69-23m4-ccvv github.com/elastic/beats (Go) Fixed in 8.19.9 Advisory →
Fix · GHSA-fj69-23m4-ccvv github.com/elastic/beats (Go) Fixed in 9.1.9 Advisory →
Fix · GHSA-fj69-23m4-ccvv github.com/elastic/beats (Go) Fixed in 9.2.3 Advisory →
Fix · GHSA-fj69-23m4-ccvv github.com/elastic/beats/v7 (Go) Fixed in 7.0.0-alpha2.0.20251209162832-28cfc80d2f4e Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-68388
2026-10-03 Alias added: GHSA-fj69-23m4-ccvv

References

Advisory 2

Other 2

TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
TI-2015-01295 The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows… KEVCVSS 3.1CRITICAL 9.8
TI-2014-02491 The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which… KEVCVSS 3.1HIGH 8.1
TI-2018-12328 Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the… CVSS 3.0CRITICAL 9.8
TI-2023-15037 Elasticsearch StackOverflow vulnerability CVSS 3.1HIGH 7.5
TI-2021-05135 Information disclosure in Elasticsearch CVSS 3.1MEDIUM 6.5

See all 414 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences