Medium severity5.7NVD Advisory· Published Mar 19, 2026· Updated Sep 4, 2026
CVE-2026-26931
CVE-2026-26931
Description
Memory Allocation with Excessive Size Value (CWE-789) in the Prometheus remote_write HTTP handler in Metricbeat can lead Denial of Service via Excessive Allocation (CAPEC-130).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/elastic/beats/v7Go | < 7.0.0-alpha2.0.20260112100137-de072c4e371e | 7.0.0-alpha2.0.20260112100137-de072c4e371e |
Affected products
36- osv-coords35 versionspkg:apk/chainguard/heartbeat-fips-9.5pkg:apk/chainguard/agentbeatpkg:apk/chainguard/metricbeat-fips-9.3pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0pkg:apk/chainguard/auditbeat-9.3pkg:apk/chainguard/filebeat-fips-9.3pkg:apk/chainguard/heartbeat-fips-8.19pkg:apk/chainguard/auditbeat-8.19pkg:apk/chainguard/filebeat-fips-9.2pkg:apk/chainguard/heartbeat-9.4pkg:apk/chainguard/metricbeat-9.3pkg:apk/chainguard/auditbeat-9.4pkg:apk/chainguard/filebeat-fips-9.4pkg:apk/chainguard/heartbeat-fips-9.2pkg:apk/chainguard/agentbeat-fipspkg:apk/chainguard/filebeat-9.3pkg:apk/chainguard/heartbeat-8.19pkg:apk/chainguard/auditbeat-fips-9.2pkg:apk/chainguard/auditbeat-fips-9.5pkg:apk/chainguard/filebeat-8.19pkg:apk/chainguard/metricbeat-8.19pkg:apk/chainguard/metricbeat-fips-8.19pkg:apk/chainguard/filebeat-fips-8.19pkg:apk/chainguard/heartbeat-9.3pkg:apk/chainguard/metricbeat-fips-9.4pkg:golang/github.com/elastic/beats/v7pkg:apk/chainguard/filebeat-9.4pkg:apk/chainguard/filebeat-fips-9.5pkg:apk/chainguard/heartbeat-fips-9.3pkg:apk/chainguard/auditbeat-fips-8.19pkg:apk/chainguard/metricbeat-fips-9.2pkg:apk/chainguard/heartbeat-fips-9.4pkg:apk/chainguard/auditbeat-fips-9.4pkg:apk/chainguard/metricbeat-9.4pkg:apk/chainguard/auditbeat-fips-9.3
< 0+ 34 more
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0.0.20260723T184607-160000.1.1
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 9.4.1-r4
- (no CPE)range: < 7.0.0-alpha2.0.20260112100137-de072c4e371e
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- Elastic/Metricbeatv5Range: 8.0.0
Patches
Vulnerability mechanics
References
4- discuss.elastic.co/t/metricbeat-8-19-13-9-2-5-security-update-esa-2026-09/385532nvdMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-5vrw-qjxw-89r5ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-26931ghsaADVISORY
- github.com/elastic/beats/commit/de072c4e371eafeb2a42d65b9ad513f666e4ffd7ghsaWEB
News mentions
0No linked articles in our index yet.