Unbounded memory allocation in Elastic Filebeat can cause denial of service

Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker able to reach the Filebeat HTTP ingestion endpoint could send specially crafted compressed requests that exhaust the memory resources of the Filebeat process.

• Elastic Filebeat 8.x: versions from 8.0.0 through 8.19.17 are affected. The issue is resolved in Filebeat 8.19.18.
• Elastic Filebeat 9.x: versions from 9.0.0 through 9.3.0 are affected. The issue is resolved in Filebeat 9.3.1.
• Configuration scope: only deployments where the HTTP endpoint input has been explicitly enabled are affected. The input is disabled by default; Elastic states that deployments where it has not been enabled are not affected.

Elastic Filebeat processes attacker-controlled compressed requests through its HTTP ingestion endpoint. The flaw is classified as CWE-770 because request handling can allocate memory without adequate limits or throttling, leading to exhaustion of the Filebeat process memory. The attack is network reachable, requires low privileges, and does not require user interaction. Only deployments with the HTTP endpoint input explicitly enabled are within the affected configuration scope; the input is disabled by default. The public advisory does not identify the specific compression format, parser, allocation site, or resource limit involved.

Exploitation requires an attacker to reach the Filebeat HTTP ingestion endpoint with low-level privileges. The attack is described as network based, low complexity, and independent of user interaction. The supplied record does not identify a public exploit; the available GCVE record marks exploitation as none. Elastic states that no specific indicators of compromise have been identified for this vulnerability. This status does not guarantee that new exploitation will not emerge later.

Successful exploitation can exhaust Filebeat process memory and prevent the service from processing ingestion normally. The established impact is to process and collection availability; the record does not establish an effect on confidentiality or integrity. The attacker needs low-level privileges and access to the endpoint, so exposing the endpoint on a reachable network can broaden the set of possible attack sources. The duration of disruption, extent of data loss, and automatic recovery behavior are not disclosed.

The flaw can disrupt Filebeat and stop or degrade event collection and forwarding from configured sources. Possible consequences include telemetry gaps, delayed detection of operational or security events, and service recovery work. The primary risk is availability; the record does not establish disclosure of data or modification of collected data. Organizations using the HTTP endpoint input for ingestion should prioritize upgrading or disable the input when it is not operationally required.

1. Upgrade to Filebeat 8.19.18 for affected 8.x deployments, or to Filebeat 9.3.1 for affected 9.x deployments.
2. If an immediate upgrade is not possible, disable the HTTP endpoint input when it is not operationally required.
3. After the change, verify the running version and recheck the HTTP endpoint input state on each deployment. Do not infer the status of branches or configurations that are not covered by the Elastic advisory.

1. Inventory Filebeat deployments and compare each running version with the affected branches.
2. Review configuration to determine whether the HTTP endpoint input is explicitly enabled. The input is disabled by default, but the default state does not protect deployments where it has been enabled.
3. Review abnormal memory consumption, Filebeat process termination or restart events, service health, and gaps in collection activity around requests received by the HTTP endpoint. Treat this as precautionary monitoring, not as a vendor-confirmed indicator.
4. Do not treat the absence of log evidence or an identified IOC as proof that a deployment is safe.