Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2026-0528
Good to know:
Date: January 13, 2026
Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed payloads sent to the Graphite server metricset or Zookeeper server metricset. Additionally, Improper Input Validation (CWE-20) exists in the Prometheus helper module that can allow an attacker to cause a Denial of Service through Input Data Manipulation (CAPEC-153) via specially crafted, malformed metric data.
Severity Score
Related Resources (7)
Severity Score
Weakness Type (CWE)
Improper Validation of Array Index
CWE-129Top Fix
Upgrade Version
Upgrade to version github.com/elastic/beats/v7 - v7.0.0-alpha2.0.20251217054608-6e42552a23ce;https://github.com/elastic/beats.git - v9.2.4;https://github.com/elastic/beats.git - v9.1.10;https://github.com/elastic/beats.git - v8.19.10
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | ADJACENT_NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | NONE |
| User Interaction (UI): | NONE |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | NONE |
| Integrity (I): | NONE |
| Availability (A): | HIGH |