CVE-2025-68383
Medium
Description
Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbeat Dissect processor can allow a user to trigger a Buffer Overflow (CAPEC-100) and cause a denial of service (panic/crash) of the Filebeat process via either a malformed Syslog message or a malicious tokenizer pattern in the Dissect configuration.
SeverityMedium
CVSS6.5
Exploit probability—
ProductElastic Filebeat
PublishedDec 18, 2025
First seenDec 18, 2025
Weakness typeCWE-1284CWE-1284
How to fix
Update
- elastic filebeat8.19.9, 9.1.9, 9.2.3 or later
- github.com/elastic/beats/v78.19.9, 9.1.9, 9.2.3, 7.0.0-alpha2.0.20251204214633-dd3af18220bf or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| elastic filebeat | 7.0.0 ≤ v ≤ 7.17.29, 8.0.0 ≤ v < 8.19.9, 9.0.0 ≤ v < 9.1.9, 9.2.0 ≤ v < 9.2.3 | 8.19.9, 9.1.9, 9.2.3 |
| github.com/elastic/beats/v7Go | 7.7.0 ≤ v < 8.19.9, 9.0.0 ≤ v < 9.1.9, 9.2.0 ≤ v < 9.2.3, v < 7.0.0-alpha2.0.20251204214633-dd3af18220bf, 7.7.0 ≤ v | 8.19.9, 9.1.9, 9.2.3, 7.0.0-alpha2.0.20251204214633-dd3af18220bf |
| github.com/elastic/beatsGo | v ≤ 7.6.2, No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.