Executive brief
Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments in github.com/elastic/beats
Affected products
- Go github.com/elastic/beats
- Go github.com/elastic/beats/v7
Junglewise Threat Intelligence
CVE-2025-68388: GO-2025-4253 - Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments in github.com/elastic/beats
CVE-2025-68388 · Severity: low · CVSS 3.1 · Published 2026-01-23
Technologies: github.com/elastic/beats (Go), github.com/elastic/beats/v7 (Go). Vendors: Go.
Related threats
- GO-2026-4789 - Packetbeat does not properly validate an array index in multiple protocol parser components in github.com/elastic/beats
- Elastic Metricbeat Prometheus remote_write denial of service
- GO-2026-4360 - Metricbeat affected by multiple denial of service vulnerabilities in github.com/elastic/beats
- GO-2023-2413 - Sensitive information logged in github.com/elastic/beats/v7
- GO-2022-0643 - Denial of service in github.com/elastic/beats