Improper validation of an array index in Packetbeat's PostgreSQL protocol parser can be triggered by an attacker who sends a specially crafted packet. The vulnerability, identified as CWE‑129, causes a Go runtime panic that terminates the Packetbeat process, resulting in a denial of service to the monitoring service.

Elastic Packetbeat is affected. The flaw exists in any build where the PostgreSQL protocol is explicitly enabled and configured to monitor traffic on the chosen port. No specific version range is listed, so all deployed Packetbeat instances with PostgreSQL monitoring enabled should be considered potentially impacted.

The CVSS base score is 5.7, indicating a moderate impact. The EPSS score is less than 1 %, suggesting a very low probability of exploitation at the time of analysis. Packetbeat is not listed in the CISA KEV catalog. The attack vector is inferred to be network-based; an attacker must send a malicious packet to the port that Packetbeat is monitoring. Because the exploit requires the protocol to be enabled, the risk is limited to environments where PostgreSQL traffic monitoring is in use.