Description

Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker able to reach the Filebeat HTTP ingestion endpoint could send specially crafted compressed requests that exhaust the memory resources of the Filebeat process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-02T15:17:40.307Z",
  "pubdate": "2026-09-02T15:17:40.307Z",
  "executiveSummary": "This vulnerability pertains to the improper management of resource allocation within Filebeat's HTTP ingestion mechanism, specifically classified under CWE-770: Allocation of Resources Without Limits or Throttling.\nThe flaw enables an unauthenticated attacker to trigger a Denial of Service (DoS) condition by submitting specially crafted, compressed HTTP requests that consume excessive memory.\nBy bypassing implicit resource constraints, the attacker forces the Filebeat process to over-allocate memory during the decompression phase, leading to potential process termination or system-wide resource starvation.\nThe impact is significant, as successful exploitation results in the unavailability of log shipping services, potentially causing data loss or degradation in centralized logging infrastructure.\nExploitation requires network reachability to the Filebeat HTTP ingestion endpoint. No elevated privileges are strictly necessary if the endpoint is exposed, making it an attractive target for service disruption attacks.\nOrganizations relying on Filebeat for critical log aggregation are at risk if the HTTP input is reachable from untrusted networks without adequate rate limiting or payload size restrictions.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of effective resource monitoring and strict boundary enforcement during the ingestion of HTTP-based input streams within Filebeat.\nWhen Filebeat is configured to accept HTTP inputs, it processes incoming data streams which may be compressed. The vulnerability exists where the application fails to implement hard limits on the size of the decompressed payload or the rate of resource allocation relative to the incoming request size.\nAn attacker can exploit this by crafting malicious payloads that utilize high compression ratios, a technique often referred to as a 'decompression bomb' or 'zip bomb'. When the Filebeat ingestion pipeline receives these requests, the underlying compression libraries proceed to expand the data into memory.\nBecause the allocation process lacks a throttling mechanism or a maximum memory threshold for individual requests, the process continues to claim system memory to accommodate the expanding data until the operating system's memory limits are reached or an Out-Of-Memory (OOM) killer event is triggered.\nThe attack flow proceeds as follows: 1) The attacker identifies a Filebeat instance with an active HTTP input. 2) The attacker crafts a request containing a small, highly compressed payload. 3) The attacker sends this payload to the target endpoint. 4) Filebeat attempts to decompress the input, causing memory consumption to scale disproportionately to the original request size. 5) Rapid transmission of multiple such requests exhausts available heap memory, leading to process crashes.\nThis vulnerability is an instance of CAPEC-130, where the attacker leverages the server's own resource management logic to facilitate an exhaustion attack. Since the memory management logic fails to enforce per-request limits, the attack is effective against systems that do not strictly sanitize the ingestion throughput or payload size.\nThe impact post-exploitation is a complete cessation of the Filebeat service, which directly impacts the observability of the target environment. As Filebeat acts as the primary data shipper, a service crash prevents logs from reaching back-end systems like Elasticsearch or Logstash, resulting in a gap in audit trails and monitoring capabilities."
}