CVE-2026-78588: Filebeat DOS Vulnerability via Resource Exhaustion

CVE-2026-78588 Overview

CVE-2026-78588 is a denial of service vulnerability in Elastic Filebeat caused by Allocation of Resources Without Limits or Throttling [CWE-770]. An attacker with network access to the Filebeat HTTP ingestion endpoint can send specially crafted compressed requests that exhaust the memory of the Filebeat process. The flaw maps to CAPEC-130 (Excessive Allocation) and requires low privileges but no user interaction. Successful exploitation results in loss of availability for the Filebeat log-shipping agent, disrupting downstream telemetry pipelines that feed SIEM and observability platforms.

Critical Impact
A remote authenticated attacker can crash the Filebeat process by submitting compressed payloads that expand to consume all available memory, breaking log ingestion.

Affected Products

Elastic Filebeat versions prior to 8.19.18
Elastic Filebeat versions prior to 9.3.1
Deployments exposing the Filebeat HTTP input to untrusted networks

Discovery Timeline

2026-09-02 - CVE-2026-78588 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-78588

Vulnerability Analysis

Filebeat exposes an HTTP ingestion endpoint that accepts events for forwarding to Elasticsearch, Logstash, or other outputs. The endpoint accepts compressed request bodies and decompresses them into memory before parsing. The implementation does not enforce limits on the decompressed size or on the memory allocated to hold intermediate buffers.

An attacker who can reach the endpoint and authenticate with low privileges submits a small compressed payload with a high compression ratio. The decompressor allocates buffers proportional to the uncompressed size, driving the Filebeat process toward memory exhaustion. This is a classic compression bomb pattern applied to a log-ingestion agent.

The vulnerability affects availability only. There is no confidentiality or integrity impact according to the CVSS vector. However, because Filebeat is frequently deployed as a critical telemetry component, a crash creates observability gaps that can mask concurrent intrusion activity.

Root Cause

The root cause is missing input validation on the size of decompressed HTTP request bodies. The ingestion handler trusts the client-supplied compressed stream and allocates resources without applying a maximum decompressed length, a per-request memory ceiling, or streaming limits. This matches [CWE-770] — Allocation of Resources Without Limits or Throttling.

Attack Vector

The attack vector is network-based and requires the attacker to reach the Filebeat HTTP input. Authentication with low privileges is required. The attacker crafts a request containing a highly compressible payload (for example, long runs of repeated bytes) encoded with gzip or a similar codec. When Filebeat decompresses the payload, it allocates memory proportional to the expanded size and the process is terminated by the operating system out-of-memory killer or crashes on allocation failure. Repeated requests sustain the denial of service.

See the Elastic Security Update Discussion for vendor technical details.

Detection Methods for CVE-2026-78588

Indicators of Compromise

Filebeat process restarts, OOM-kill events in dmesg, or systemd filebeat.service failure entries correlated with inbound HTTP traffic.
HTTP requests to the Filebeat ingestion endpoint with Content-Encoding: gzip and unusually high decompression ratios.
Sudden gaps in downstream log ingestion accompanied by memory pressure alerts on Filebeat hosts.

Detection Strategies

Monitor Filebeat host memory utilization and process exit codes for anomalies aligned with ingress traffic spikes.
Inspect HTTP access logs or upstream reverse-proxy logs for repeated compressed POST requests from the same source with small request sizes but high processing cost.
Alert on Filebeat service restarts using host telemetry or systemd journald events forwarded to a SIEM.

Monitoring Recommendations

Instrument Filebeat metrics endpoints and track beat.memstats.memory_alloc and process uptime.
Forward operating system OOM events and Filebeat crash logs to a centralized data lake for correlation.
Baseline expected request sizes to the HTTP input and alert on outliers in compression ratio.

How to Mitigate CVE-2026-78588

Immediate Actions Required

Upgrade Filebeat to version 8.19.18, 9.3.1, or later as identified in the Elastic advisory ESA-2026-165.
Restrict network access to the Filebeat HTTP ingestion endpoint to trusted sources using firewall rules or service mesh policies.
Rotate any credentials used to authenticate to the HTTP input if exposure to untrusted networks is suspected.

Patch Information

Elastic released fixed builds in the 8.19 and 9.3 branches. Refer to the Elastic Security Update Discussion for ESA-2026-165 for release notes and download locations. Apply the vendor patch to all Filebeat instances that expose the HTTP input.

Workarounds

Disable the Filebeat HTTP input if it is not required by commenting out the http input block in filebeat.yml.
Front the HTTP input with a reverse proxy that enforces a maximum request body size and rejects requests with excessive Content-Length or decompression ratios.
Apply per-source rate limiting at the network layer to constrain the volume of compressed requests any single client can submit.

bash

# Example nginx reverse-proxy limits in front of Filebeat HTTP input
http {
    client_max_body_size 1m;
    limit_req_zone $binary_remote_addr zone=filebeat:10m rate=10r/s;

    server {
        listen 8080;
        location /filebeat {
            limit_req zone=filebeat burst=20 nodelay;
            proxy_pass http://127.0.0.1:8000;
        }
    }
}