6.5

CVE-2025-68383

Filebeat Improper Validation of Specified Index, Position, or Offset in Input

Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbeat Dissect processor can allow a user to trigger a Buffer Overflow (CAPEC-100) and cause a denial of service (panic/crash) of the Filebeat process via either a malformed Syslog message or a malicious tokenizer pattern in the Dissect configuration.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Elastic ≫ Filebeat Version >= 7.0.0 <= 7.17.29
Elastic ≫ Filebeat Version >= 8.0.0 < 8.19.9
Elastic ≫ Filebeat Version >= 9.0.0 < 9.1.9
Elastic ≫ Filebeat Version >= 9.2.0 < 9.2.3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.064
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@elastic.co 6.5 2.8 3.6
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1284 Improper Validation of Specified Quantity in Input

The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

https://discuss.elastic.co/t/filebeat-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-32/384180
Vendor Advisory