Improper validation of array indices and generic input validation flaws in Metricbeat can allow an attacker to send specially crafted, malformed metric data that makes the service consume excessive resources and ultimately fail to respond. The vulnerability resides in the Graphite and Zookeeper metric sets as well as the Prometheus helper module, enabling a denial‑of‑service attack via input data manipulation.

Elastic Metricbeat deployments are affected, especially those using the Graphite or Zookeeper metric sets or the Prometheus helper module. All versions prior to the security update 8.19.10‑9.1‑10.9‑2‑4 lack the necessary checks and are vulnerable.

The CVSS score of 6.5 indicates medium severity, while an EPSS of less than 1% suggests a low chance of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote, achievable by any actor that can transmit metric data to a Metricbeat instance – for example, a malicious data source sending crafted payloads to the Graphite, Zookeeper, or Prometheus endpoints.