Elastic Packetbeat CVE-2026-115297

Exploitation requires that a Packetbeat sensor be deployed with AMQP protocol monitoring/sniffing enabled, and that the attacker can inject AMQP traffic onto a network segment that this sensor observes - this is the exact precondition stated in the description ('a network segment that Packetbeat monitors for AMQP'). No AMQP authentication and no Packetbeat credentials are needed, and a single crafted packet suffices. The principal limiting factor is the Adjacent attack vector (AV:A): the attacker must have a foothold on, or traffic-injection capability into, the monitored segment - this is not remotely reachable across the internet against an exposed service. A further precondition is that AMQP protocol analysis is actually configured; sensors not monitoring AMQP are not affected. Impact is confined to availability (process crash and loss of telemetry), with no confidentiality or integrity consequence.

This is a medium-severity denial-of-service issue (CVSS 6.5) whose real-world urgency is moderate and self-consistent across the available signals. The CVSS vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H is coherent with the description: the attack vector is Adjacent (AV:A), not Network, because the attacker must be able to place AMQP traffic onto a network segment that Packetbeat is actively monitoring - not reach an arbitrary internet-facing listening service. Complexity is low and no privileges or user interaction are needed (AC:L/PR:N/UI:N), and the only impact is availability (A:H) with no confidentiality or integrity loss, matching a NULL-pointer-dereference crash (CWE-476). No EPSS score was supplied, the CVE is not listed in CISA KEV, and no proof-of-concept or exploit reference is present - only the Elastic vendor advisory. The vuln.today decision label is 'this_month', consistent with a medium-impact DoS rather than an emergency. The practical risk is a reliability/monitoring-gap problem: a single crafted packet terminates the Packetbeat process, and while it is down no network telemetry is collected, which can create a detection blind spot - but there is no code execution or data exposure. No signals conflict here; the main caveat is that EPSS and POC status are simply absent from the input rather than confirmed negative.

An attacker positioned on a network segment that a Packetbeat sensor is configured to monitor for AMQP sends a single specially crafted AMQP packet. The malformed traffic triggers a NULL pointer dereference in Packetbeat's AMQP parser, causing a Go runtime panic that terminates the process; no AMQP authentication is required. While Packetbeat is down it stops collecting network telemetry, creating a monitoring gap until it is restarted. No public exploit code or PoC reference is present in the provided data.