# CVE-2026-115297: Elastic Packetbeat NULL pointer dereference in AMQP parser

Source: https://junglewise.ai/threats/cve-2026-115297-null-pointer-dereference-cwe-476-in-the-amqp-protocol-parser-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-115297 · Severity: medium · CVSS 6.5 · Published 2026-11-03

Packetbeat is a network packet analyzer that captures and decodes traffic protocols. A flaw in its AMQP protocol parser can crash the Packetbeat process when it receives a specially crafted network packet, disrupting network traffic monitoring and telemetry collection. An attacker on the same network segment can trigger this denial of service without authentication.

Vendors: [Elastic](https://junglewise.ai/threats/vendors/elastic).

## Quick answers

**Is CVE-2026-115297 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115297 being exploited in the wild.

**How severe is CVE-2026-115297?** Medium severity, with a CVSS score of 6.5, published 3 November 2026.

**Which products and versions are affected?** Elastic Agent All versions with Network Packet Capture integration enabled for AMQP data stream; Elastic Packetbeat 8.0.0–8.19.23, 9.0.0–9.4.8, 9.5.0–9.5.5.

**Is there a fix for CVE-2026-115297?** Yes: fixed in Packetbeat 8.19.24, 9.4.9, 9.5.6; Elastic Agent versions containing the same fix. Until then: If AMQP monitoring is not required, remove the AMQP protocol from the Packetbeat configuration. Alternatively, disable AMQP message header parsing in the AMQP protocol configuration, though this will prevent collection of AMQP message properties. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115297 attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected by CVE-2026-115297?** Check whether you run Elastic Agent or Elastic Packetbeat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Packetbeat 8.19.24, 9.4.9, 9.5.6; Elastic Agent versions containing the same fix

If AMQP monitoring is not required, remove the AMQP protocol from the Packetbeat configuration. Alternatively, disable AMQP message header parsing in the AMQP protocol configuration, though this will prevent collection of AMQP message properties.

## Technical details

A NULL pointer dereference (CWE-476) exists in Packetbeat's AMQP protocol parser that can be triggered by a malformed AMQP packet, causing a Go runtime panic and process termination. The vulnerability requires only network access to a segment that Packetbeat monitors; no authentication is needed. The attack surface is enlarged because AMQP protocol monitoring and message header parsing are enabled by default.

## Affected products

- Elastic Packetbeat 8.0.0–8.19.23, 9.0.0–9.4.8, 9.5.0–9.5.5
- Elastic Elastic Agent All versions with Network Packet Capture integration enabled for AMQP data stream

## Timeline

- 2026-11-03: disclosed: CVE-2026-115297 published
- 2026-11-03: patched: Fixed in Packetbeat 8.19.24, 9.4.9, 9.5.6

## References

- [https://discuss.elastic.co/t/packetbeat-8-19-24-9-4-9-9-5-6-security-update-esa-2026-208/391361](https://discuss.elastic.co/t/packetbeat-8-19-24-9-4-9-9-5-6-security-update-esa-2026-208/391361)

## Related threats

- [Elastic Docker images certificate validation flaw in OS bundle](https://junglewise.ai/threats/cve-2026-115714-improper-certificate-validation-cwe-295-in-the-operating-system)