Executive brief
Filebeat is a log and data collection agent used to ship operational data to centralized logging platforms. An attacker with network access to Filebeat's HTTP ingestion endpoint can send malicious compressed requests that consume excessive memory, causing the Filebeat process to crash and halt data collection operations.
Technical details
This vulnerability is a resource exhaustion flaw (CWE-770) in Filebeat's HTTP endpoint input. An attacker can craft specially compressed requests that trigger uncontrolled memory allocation, leading to denial of service. The attack requires network reachability to the HTTP ingestion endpoint (which is disabled by default) and does not require authentication according to the CVSS vector (AV:N/AC:L/PR:L indicating low privilege requirement). The vulnerability affects Filebeat 8.0.0–8.19.17 and 9.0.0–9.3.0, and is resolved in versions 8.19.18 and 9.3.1.
Affected products
- Elastic Filebeat 8.0.0 to 8.19.17, 9.0.0 to 9.3.0
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: Fixed in Filebeat 8.19.18 and 9.3.1