CVE-2026-78588CWE-770denial-of-service

CVE-2026-78588

Medium · published September 2, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
35.3
In the wild
Unconfirmed
What it is

Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker able to reach the Filebeat HTTP ingestion endpoint could send specially crafted compressed requests that exhaust the memory resources of the Filebeat process.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00420 · 35.3th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-09-02T19:17Z
Affected products (2)
ProductVersionsFixed in
elastic/filebeat≥ 8.0.0, < 8.19.188.19.18
elastic/filebeat≥ 9.0.0, < 9.3.19.3.1
References (1)
https://discuss.elastic.co/t/filebeat-8-19-18-9-3-1-security-update-esa-2026-165/390118 · [email protected]
EPSS history
Timeline
  • 04 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 02 SEP 14:43Z
    Allocation of Resources Without Limits or Throttling in Filebeat Leading to Denial of Service
    cvelistv5