CVE-2025-68388: Elasticsearch Packetbeat has Excessive Allocation of Memory and CPU via Malicious IPv4 Fragments

December 19, 2025 (updated December 20, 2025)

Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC-130) of memory and CPU via the integration of malicious IPv4 fragments, leading to denial-of-service in Packetbeat.

References

discuss.elastic.co/t/packetbeat-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-29/384177
github.com/advisories/GHSA-fj69-23m4-ccvv
github.com/elastic/beats
github.com/elastic/beats/commit/28cfc80d2f4e80bfd1c72eb3f849d777751ab870
nvd.nist.gov/vuln/detail/CVE-2025-68388

Code Behaviors & Features

Detect and mitigate CVE-2025-68388 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →