Packetbeat 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-208)

Announcements Security Announcements
1

NULL Pointer Dereference in Packetbeat Leading to Denial of Service

NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat monitors for AMQP can cause a Go runtime panic that terminates the Packetbeat process. A single crafted packet is sufficient. No AMQP authentication is necessary. While Packetbeat is not running, it does not collect network telemetry.

Affected Versions:

  • 8.x: All versions from 8.0.0 up to and including 8.19.23
  • 9.x:
  • All versions from 9.0.0 up to and including 9.4.8
  • All versions from 9.5.0 up to and including 9.5.5

Affected Configurations:

  • Packetbeat deployments that have the AMQP protocol enabled and that monitor a network interface where an attacker can send traffic to a monitored AMQP port. The AMQP protocol is enabled in the default Packetbeat configuration file. AMQP message header parsing is enabled by default.
  • Elastic Agent is also affected when the Network Packet Capture integration is enabled with its AMQP data stream, because the integration uses the same protocol decoder. Users of the Network Packet Capture integration must upgrade Elastic Agent to one of the fixed versions.

Solutions and Mitigations:

The issue is resolved in versions 8.19.24, 9.4.9, and 9.5.6.

The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading.

For Users that Cannot Upgrade:

  • If AMQP monitoring is not necessary, remove the AMQP protocol from the Packetbeat configuration.
  • If AMQP monitoring is necessary, disable AMQP message header parsing in the AMQP protocol configuration. Packetbeat then does not record AMQP message properties.

Indicators of Compromise (IOC)

Unexpected Packetbeat process terminations can indicate exploitation attempts. Look for:

  • Packetbeat log output or service manager output that shows the process exit with a Go runtime panic whose stack trace references the AMQP protocol parser.

Severity: CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE ID: CVE-2026-115297
Problem Type: CWE-476 - NULL Pointer Dereference