CVE-2026-115297
Received Received - Intake

NULL Pointer Dereference in Packetbeat AMQP Parser

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: Elastic

Description
NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat monitors for AMQP can cause a Go runtime panic that terminates the Packetbeat process. A single crafted packet is sufficient. No AMQP authentication is necessary. While Packetbeat is not running, it does not collect network telemetry.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-115297
EUVD
EUVD-2026-116077

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Elastic Packetbeat 8.0.0
Elastic Packetbeat 9.0.0
Elastic Packetbeat 9.5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a NULL Pointer Dereference vulnerability in Packetbeat's AMQP protocol parser. It allows an unauthenticated attacker to send a specially crafted AMQP packet that triggers a Go runtime panic, causing Packetbeat to crash and stop collecting network telemetry. The issue affects versions 8.19.23 and earlier, 9.4.8 and earlier, and 9.5.5 and earlier.

Detection Guidance

Monitor Packetbeat logs for crashes or Go runtime panics. Check for unexpected terminations of Packetbeat processes. Use network traffic analysis tools like Wireshark to inspect AMQP traffic for malformed packets.

Impact Analysis

If you use Packetbeat to monitor AMQP traffic, an attacker could exploit this to crash Packetbeat, disrupting your network monitoring and telemetry collection. This could lead to loss of visibility into network activity, affecting security and operational monitoring.

Mitigation Strategies

Upgrade Packetbeat to versions 8.19.24, 9.4.9, or 9.5.6 or later. Disable AMQP monitoring if not required. If monitoring is necessary, disable AMQP message header parsing as a temporary measure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115297. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...