{"affected":[{"defaultStatus":"unaffected","product":"Packetbeat","source":"CNA: elastic","vendor":"Elastic","versions":[{"lessThanOrEqual":"8.19.23","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"9.4.8","status":"affected","version":"9.0.0","versionType":"semver"},{"lessThanOrEqual":"9.5.5","status":"affected","version":"9.5.0","versionType":"semver"}]}],"cveId":"CVE-2026-115297","cwes":["CWE-476"],"description":"NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat monitors for AMQP can cause a Go runtime panic that terminates the Packetbeat process. A single crafted packet is sufficient. No AMQP authentication is necessary. While Packetbeat is not running, it does not collect network telemetry.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.5,"severity":"medium","source":"CNA: elastic","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1793727133915,"publishedAt":1793724248051,"references":[{"source":"CNA: elastic","tags":[],"url":"https://discuss.elastic.co/t/packetbeat-8-19-24-9-4-9-9-5-6-security-update-esa-2026-208/391361"}],"remediation":[],"revision":"9515cdcd18eb4f4987b6a9731699d3f5f9dbaecbdb3ba55ad3f5160fd6394ebe","sources":[{"modifiedAt":1793727133915,"name":"CNA: elastic","retrievedAt":1793729334833,"url":"https://www.cve.org/CVERecord?id=CVE-2026-115297"}],"ssvc":{"assessedAt":1793727122231,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"NULL Pointer Dereference in Packetbeat Leading to Denial of Service","updatedAt":1793729334833}