Live › vulnerability › CVE-2026-115297
Packetbeat, Elastic's network monitoring agent, has a null pointer dereference in its AMQP protocol parser. A single crafted packet on a monitored network segment makes the Go process panic and exit, stopping network telemetry collection.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Only deployments of Packetbeat that monitor a network segment carrying AMQP traffic are exposed, since the crafted packet must reach the parser. An attacker needs no account, only the ability to send packets on that monitored segment. Hosts where AMQP is not monitored or where Packetbeat is not deployed can skip it.
No product ranges from the sources yet.
packetbeat versionpacketbeat.yml) under packetbeat.protocolsNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat monitors for AMQP can cause a Go runtime panic that terminates the Packetbeat process. A single crafted packet is sufficient. No AMQP authentication is necessary. While Packetbeat is not running, it does not collect network telemetry.
This page as .md · .json · in your agent: get_signal("CVE-2026-115297")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.