---
id: CVE-2026-115297
title: NULL Pointer Dereference in Packetbeat Leading to Denial of Service
summary: >-
  NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat
  can lead to denial of service via specially crafted network traffic. An
  unauthenticated attacker who can send traffic on a network segment that
  Packetbeat monit…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-476
vendor: Elastic
product: Packetbeat
affected:
  - Packetbeat >= 8.0.0 <= 8.19.23
  - Packetbeat >= 9.0.0 <= 9.4.8
  - Packetbeat >= 9.5.0 <= 9.5.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T17:32:02.231511Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T17:32:13.915Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115297'
references:
  - url: >-
      https://discuss.elastic.co/t/packetbeat-8-19-24-9-4-9-9-5-6-security-update-esa-2026-208/391361
tags:
  - cve.org
epss: 0.00297
epssPercentile: 0.22506
ingestedAt: '2026-11-05T20:33:06.327Z'
---

## Overview

NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat monitors for AMQP can cause a Go runtime panic that terminates the Packetbeat process. A single crafted packet is sufficient. No AMQP authentication is necessary. While Packetbeat is not running, it does not collect network telemetry.

## Affected

- `Packetbeat >= 8.0.0 <= 8.19.23`
- `Packetbeat >= 9.0.0 <= 9.4.8`
- `Packetbeat >= 9.5.0 <= 9.5.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.