{"id":"CVE-2026-115297","kind":"vulnerability","aliases":["CVE-2026-115297"],"related":[],"title":"Packetbeat: crafted AMQP traffic crashes the monitoring agent process","description":"NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat monitors for AMQP can cause a Go runtime panic that terminates the Packetbeat process. A single crafted packet is sufficient. No AMQP authentication is necessary. While Packetbeat is not running, it does not collect network telemetry.","summary":"Packetbeat, Elastic's network monitoring agent, has a null pointer dereference in its AMQP protocol parser. A single crafted packet on a monitored network segment makes the Go process panic and exit, stopping network telemetry collection.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amqp","elastic","infrastructure","observability","packetbeat"],"not_affected_if":["amqp-not-monitored","packetbeat-not-deployed"],"how_to_check":"- Check the installed Packetbeat version with `packetbeat version`\n- Check whether the AMQP protocol is enabled in the Packetbeat configuration file (`packetbeat.yml`) under `packetbeat.protocols`\n- Check whether Packetbeat is running on a host that sees AMQP traffic","fix":null,"status":"open","published_at":"2026-11-03T17:17:55+00:00","first_seen_at":"2026-11-03T17:21:55+00:00","triaged_at":"2026-11-03T17:24:16+00:00","updated_at":"2026-11-03T17:24:16+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-03T17:24:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Packetbeat: crafted AMQP traffic crashes the monitoring agent process","impact":"low","summary":"Packetbeat, Elastic's network monitoring agent, has a null pointer dereference in its AMQP protocol parser. A single crafted packet on a monitored network segment makes the Go process panic and exit, stopping network telemetry collection.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["packetbeat","elastic","observability","amqp"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Packetbeat process crashes, stopping network telemetry collection","analyst_note":"Sources do not list affected or fixed Packetbeat versions; check the NVD entry and Elastic's advisory for version ranges and the fix.","how_to_check":"- Check the installed Packetbeat version with `packetbeat version`\n- Check whether the AMQP protocol is enabled in the Packetbeat configuration file (`packetbeat.yml`) under `packetbeat.protocols`\n- Check whether Packetbeat is running on a host that sees AMQP traffic","plain_action":"","needs_analyst":true,"not_affected_if":["amqp-not-monitored","packetbeat-not-deployed"],"who_is_affected":"Only deployments of Packetbeat that monitor a network segment carrying AMQP traffic are exposed, since the crafted packet must reach the parser. An attacker needs no account, only the ability to send packets on that monitored segment. Hosts where AMQP is not monitored or where Packetbeat is not deployed can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000726,"input_tokens":4197,"output_tokens":612,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115297':12A,15A '-2026':11A,14A '-476':61C 'agent':8A,26B 'amqp':3A,16B,34B,64C,95C,114C 'attack':82C 'authent':115C 'caus':97C 'collect':56B,126C 'craft':2A,39B,77C,109C 'crash':5A 'cve':10A,13A 'cwe':60C 'denial':72C 'derefer':31B,59C 'elast':17B,22B 'exit':52B 'go':48B,99C 'infrastructur':18B 'lead':70C 'make':46B 'monitor':7A,25B,43B,93C 'necessari':117C 'network':24B,44B,54B,78C,89C,127C 'null':29B,57C 'observ':19B 'packet':40B,110C 'packetbeat':1A,20B,21B,68C,92C,105C,119C 'panic':50B,101C 'parser':36B,66C 'pointer':30B,58C 'process':9A,49B,106C 'protocol':35B,65C 'run':122C 'runtim':100C 'segment':45B,90C 'send':85C 'servic':74C 'singl':38B,108C 'special':76C 'stop':53B 'suffici':112C 'telemetri':55B,128C 'termin':103C 'traffic':4A,79C,86C 'unauthent':81C 'via':75C","nicknames":[],"mitigations":[],"who_affected":"Only deployments of Packetbeat that monitor a network segment carrying AMQP traffic are exposed, since the crafted packet must reach the parser. An attacker needs no account, only the ability to send packets on that monitored segment. Hosts where AMQP is not monitored or where Packetbeat is not deployed can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["amqp","elastic","infrastructure","medium","observability","packetbeat"],"campaign_type":null,"first_public_at":"2026-11-03T17:17:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security@elastic.co","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115297","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115297","severity":null,"published_at":"2026-11-03T17:17:55+00:00","modified_at":"2026-11-03T17:17:55+00:00","first_seen_at":"2026-11-03T17:21:55+00:00","fetched_at":"2026-11-03T17:21:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}