CVE-2026-26931

medium

Description

Memory Allocation with Excessive Size Value (CWE-789) in the Prometheus remote_write HTTP handler in Metricbeat can lead Denial of Service via Excessive Allocation (CAPEC-130).

References

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-13139

https://discuss.elastic.co/t/metricbeat-8-19-13-9-2-5-security-update-esa-2026-09/385532

Details

Source: Mitre, NVD

Published: 2026-03-19

Updated: 2026-09-04

Named Vulnerability: GO-2026-4790Named Vulnerability: GHSA-5vrw-qjxw-89r5

Risk Information

CVSS v2

Base Score: 5.5

Vector: CVSS2#AV:A/AC:L/Au:S/C:N/I:N/A:C

Severity: Medium

CVSS v3

Base Score: 5.7

Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H