CVE-2025-68383: Filebeat Improper Validation of Specified Index, Position, or Offset in Input

Analyzed

AliasesGHSA-2mj3-6grc-px38GO-2025-4252CGA-24fc-x57m-gp36+315 more

Published 18-12-2025Last modified 19-12-2025

Vulnerability summary

CVE-2025-68383 is a medium (CVSS 6.5) vulnerability in elastic filebeat. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.8% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.5, adjacent network); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.5/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.19%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 3

OPENSUSE-SU-2026:21483-1 SUSE-SU-2026:0292-1 CGA-M658-4WW5-36J3

Timeline

18-12-2025
PublishedVulnerability first disclosed.
19-12-2025
Last modifiedVulnerability information updated.

Description

Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbeat Dissect processor can allow a user to trigger a Buffer Overflow (CAPEC-100) and cause a denial of service (panic/crash) of the Filebeat process via either a malformed Syslog message or a malicious tokenizer pattern in the Dissect configuration.

CVSS metrics

4 scores · 4 sources · 1 version

v3.16.5

EPSS trend

Probability

0.19%

Chance of exploitation in the next 30 days

Percentile

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.19% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-1284Improper Validation of Specified Quantity in InputThe product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Affected systems

Version check

Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard140 products

agentbeatAll versions (No fix recorded)
agentbeat-fipsAll versions (No fix recorded)
apm-server-7.17All versions (No fix recorded)
apm-server-8.17All versions (No fix recorded)
apm-server-8.18All versions (No fix recorded)

apm-server-8.19< 8.19.11-r0
apm-server-9.0All versions (No fix recorded)
apm-server-9.1All versions (No fix recorded)
apm-server-9.2< 9.2.3-r1
apm-server-9.2-compat< 9.2.3-r1
apm-server-fips-7.17All versions (No fix recorded)
apm-server-fips-8.17All versions (No fix recorded)
apm-server-fips-8.18All versions (No fix recorded)
apm-server-fips-8.19< 8.19.11-r0
apm-server-fips-9.0All versions (No fix recorded)
apm-server-fips-9.1All versions (No fix recorded)
apm-server-fips-9.2< 9.2.3-r1
apm-server-fips-9.2-compat< 9.2.3-r1
auditbeat-7All versions (No fix recorded)
auditbeat-8.17All versions (No fix recorded)
auditbeat-8.18All versions (No fix recorded)
auditbeat-8.19All versions (No fix recorded)
auditbeat-8.19-oci-entrypointAll versions (No fix recorded)
auditbeat-9.0All versions (No fix recorded)
auditbeat-9.1All versions (No fix recorded)
auditbeat-9.1-oci-entrypointAll versions (No fix recorded)
auditbeat-9.2All versions (No fix recorded)
auditbeat-9.2-oci-entrypointAll versions (No fix recorded)
auditbeat-9.3All versions (No fix recorded)
auditbeat-9.4< 9.4.2-r2
auditbeat-fips-7All versions (No fix recorded)
auditbeat-fips-8.17All versions (No fix recorded)
auditbeat-fips-8.18All versions (No fix recorded)
auditbeat-fips-8.19All versions (No fix recorded)
auditbeat-fips-9.0All versions (No fix recorded)
auditbeat-fips-9.1All versions (No fix recorded)
auditbeat-fips-9.2All versions (No fix recorded)
auditbeat-fips-9.3All versions (No fix recorded)
auditbeat-fips-9.4< 9.4.1-r4
auditbeat-fips-9.5All versions (No fix recorded)
beats-8.19All versions (No fix recorded)
beats-9.1All versions (No fix recorded)
beats-9.2All versions (No fix recorded)
beats-fips-8.19All versions (No fix recorded)
beats-fips-9.1All versions (No fix recorded)
beats-fips-9.2All versions (No fix recorded)
cloudbeat-8.17All versions (No fix recorded)
cloudbeat-8.18All versions (No fix recorded)
cloudbeat-8.19< 8.19.12-r0
cloudbeat-9.0All versions (No fix recorded)
cloudbeat-9.1All versions (No fix recorded)
cloudbeat-9.2< 9.2.6-r0
cloudbeat-9.3< 9.3.1-r0
cloudbeat-fips-8.17All versions (No fix recorded)
cloudbeat-fips-8.18All versions (No fix recorded)
cloudbeat-fips-8.19< 8.19.12-r0
cloudbeat-fips-9.0All versions (No fix recorded)
cloudbeat-fips-9.1All versions (No fix recorded)
cloudbeat-fips-9.2< 9.2.6-r0
cloudbeat-fips-9.3< 9.3.0-r2
elastic-agent< 9.2.3-r0
elastic-agent-8.17All versions (No fix recorded)
elastic-agent-8.18All versions (No fix recorded)
elastic-agent-9.0All versions (No fix recorded)
elastic-agent-fips-8.17All versions (No fix recorded)
elastic-agent-fips-8.18All versions (No fix recorded)
elastic-agent-fips-9.0All versions (No fix recorded)
filebeat-7All versions (No fix recorded)
filebeat-8.17All versions (No fix recorded)
filebeat-8.18All versions (No fix recorded)
filebeat-8.19All versions (No fix recorded)
filebeat-8.19-oci-entrypointAll versions (No fix recorded)
filebeat-9.0All versions (No fix recorded)
filebeat-9.1All versions (No fix recorded)
filebeat-9.1-oci-entrypointAll versions (No fix recorded)
filebeat-9.2All versions (No fix recorded)
filebeat-9.2-oci-entrypointAll versions (No fix recorded)
filebeat-9.3All versions (No fix recorded)
filebeat-9.4< 9.4.2-r2
filebeat-fips-7All versions (No fix recorded)
filebeat-fips-8.17All versions (No fix recorded)
filebeat-fips-8.18All versions (No fix recorded)
filebeat-fips-8.19All versions (No fix recorded)
filebeat-fips-9.0All versions (No fix recorded)
filebeat-fips-9.1All versions (No fix recorded)
filebeat-fips-9.2All versions (No fix recorded)
filebeat-fips-9.3All versions (No fix recorded)
filebeat-fips-9.4< 9.4.1-r4
filebeat-fips-9.5All versions (No fix recorded)
filebeat-oss-7All versions (No fix recorded)
filebeat-oss-fips-7All versions (No fix recorded)
heartbeat-7All versions (No fix recorded)
heartbeat-8.17All versions (No fix recorded)
heartbeat-8.18All versions (No fix recorded)
heartbeat-8.19All versions (No fix recorded)
heartbeat-8.19-oci-entrypointAll versions (No fix recorded)
heartbeat-9.0All versions (No fix recorded)
heartbeat-9.1All versions (No fix recorded)
heartbeat-9.1-oci-entrypointAll versions (No fix recorded)
heartbeat-9.2All versions (No fix recorded)
heartbeat-9.2-oci-entrypointAll versions (No fix recorded)
heartbeat-9.3All versions (No fix recorded)
heartbeat-9.4< 9.4.2-r2 | All versions (No fix recorded)
heartbeat-fips-7All versions (No fix recorded)
heartbeat-fips-8.17All versions (No fix recorded)
heartbeat-fips-8.18All versions (No fix recorded)
heartbeat-fips-8.19All versions (No fix recorded)
heartbeat-fips-8.19-oci-entrypointAll versions (No fix recorded)
heartbeat-fips-9.0All versions (No fix recorded)
heartbeat-fips-9.1All versions (No fix recorded)
heartbeat-fips-9.1-oci-entrypointAll versions (No fix recorded)
heartbeat-fips-9.2All versions (No fix recorded)
heartbeat-fips-9.2-oci-entrypointAll versions (No fix recorded)
heartbeat-fips-9.3All versions (No fix recorded)
heartbeat-fips-9.4< 9.4.1-r4
heartbeat-fips-9.5All versions (No fix recorded)
metricbeat-7All versions (No fix recorded)
metricbeat-8.17All versions (No fix recorded)
metricbeat-8.18All versions (No fix recorded)
metricbeat-8.19All versions (No fix recorded)
metricbeat-8.19-oci-entrypointAll versions (No fix recorded)
metricbeat-9.0All versions (No fix recorded)
metricbeat-9.1All versions (No fix recorded)
metricbeat-9.1-oci-entrypointAll versions (No fix recorded)
metricbeat-9.2All versions (No fix recorded)
metricbeat-9.2-oci-entrypointAll versions (No fix recorded)
metricbeat-9.3All versions (No fix recorded)
metricbeat-9.4< 9.4.2-r2
metricbeat-fips-7All versions (No fix recorded)
metricbeat-fips-8.17All versions (No fix recorded)
metricbeat-fips-8.18All versions (No fix recorded)
metricbeat-fips-8.19All versions (No fix recorded)
metricbeat-fips-9.0All versions (No fix recorded)
metricbeat-fips-9.1All versions (No fix recorded)
metricbeat-fips-9.2All versions (No fix recorded)
metricbeat-fips-9.3All versions (No fix recorded)
metricbeat-fips-9.4< 9.4.1-r4
metricbeat-fips-9.5All versions (No fix recorded)
wazuh-manager-filebeat-ossAll versions (No fix recorded) | < 4.14.9-r0
wazuh-manager-filebeat-oss-fipsAll versions (No fix recorded) | < 4.14.9-r0

Show all 140

Elastic1 product

filebeat≥ 8.0.0, ≤ 8.19.8 | ≥ 9.0.0, ≤ 9.1.8 | ≥ 9.2.0, ≤ 9.2.2 | ≥ 7.0.0, ≤ 7.17.29 | ≥ 8.0.0, < 8.19.9 | ≥ 9.0.0, < 9.1.9 | ≥ 9.2.0, < 9.2.3

Github.com/elastic1 product

beats≤ 7.6.2 | All versions (No fix recorded)

Github.com/elastic/beats1 product

v7≥ 7.7.0, < 8.19.9 | ≥ 9.0.0, < 9.1.9 | ≥ 9.2.0, < 9.2.3 | < 7.0.0-alpha2.0.20251204214633-dd3af18220bf | ≥ 7.7.0, < 7.0.0-alpha2.0.20251204214633-dd3af18220bf

4 vendors · 143 products

References

7 links