CVE-2025-68388

Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC-130) of memory and CPU via the integration of malicious IPv4 fragments, leading to a degradation in Packetbeat.

Score

CVSS 3.1 5.3 Medium

Status

Analyzed - security@elastic.co

Published

2025-12-18

Last modified

2025-12-19

Weaknesses

CWE-770

Affected products

• Packetbeat (Elastic)
• Packetbeat (Elasticsearch)

References

• https://discuss.elastic.co/t/packetbeat-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-29/384177