-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a denial of service in the Filebeat Dissect processor, caused by a panic when processing a malformed tokenizer pattern. The root cause is an out-of-bounds slice access in the dissect.extractKeyParts function, located in libbeat/processors/dissect/field.go. This function uses a regular expression to parse field definitions from the tokenizer string. When an invalid field definition is provided, the regex fails to find a match, resulting in an empty slice. The code then attempts to access the first element of this empty slice, which causes a panic and crashes the Filebeat agent.
The vulnerability can be triggered in two ways:
tokenizer pattern.The patch addresses this issue by adding a check to ensure the regex match slice is not empty before attempting to access its elements. If the slice is empty, an error is returned, and the dissect.newField function, which calls extractKeyParts, is updated to handle this error gracefully, preventing the panic.
Therefore, the key functions that would appear in a runtime profile during exploitation are dissect.extractKeyParts, where the crash occurs, and its direct caller, dissect.newField.
dissect.extractKeyPartslibbeat/processors/dissect/field.go
dissect.newFieldlibbeat/processors/dissect/field.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/elastic/beats/v7 | go | >= 7.7.0, < 8.19.9 | 8.19.9 |
| github.com/elastic/beats/v7 | go | >= 9.0.0, < 9.1.9 | 9.1.9 |
| github.com/elastic/beats/v7 | go | >= 9.2.0, < 9.2.3 | 9.2.3 |
| github.com/elastic/beats/v7 | go | < 7.0.0-alpha2.0.20251204214633-dd3af18220bf | 7.0.0-alpha2.0.20251204214633-dd3af18220bf |
| github.com/elastic/beats | go | <= 7.6.2 |