{"id":"CVE-2026-115297","title":"NULL Pointer Dereference in Packetbeat Leading to Denial of Service","summary":"NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat monit…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-476"],"vendor":"Elastic","product":"Packetbeat","affected":["Packetbeat >= 8.0.0 <= 8.19.23","Packetbeat >= 9.0.0 <= 9.4.8","Packetbeat >= 9.5.0 <= 9.5.5"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-03T17:32:02.231511Z"},"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T17:32:13.915Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115297","references":[{"url":"https://discuss.elastic.co/t/packetbeat-8-19-24-9-4-9-9-5-6-security-update-esa-2026-208/391361"}],"tags":["cve.org"],"epss":0.00297,"epssPercentile":0.22506,"ingestedAt":"2026-11-05T20:33:06.327Z","slug":"CVE-2026-115297","body":"## Overview\n\nNULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat monitors for AMQP can cause a Go runtime panic that terminates the Packetbeat process. A single crafted packet is sufficient. No AMQP authentication is necessary. While Packetbeat is not running, it does not collect network telemetry.\n\n## Affected\n\n- `Packetbeat >= 8.0.0 <= 8.19.23`\n- `Packetbeat >= 9.0.0 <= 9.4.8`\n- `Packetbeat >= 9.5.0 <= 9.5.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}