CVE-2026-115297
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
Nov 3, 2026
CISA due date
—
The record
NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat monitors for AMQP can cause a Go runtime panic that terminates the Packetbeat process. A single crafted packet is sufficient. No AMQP authentication is necessary. While Packetbeat is not running, it does not collect network telemetry.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121522 In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves… CWE-476
- CVE-2026-120955 The GridFS file download API in the MongoDB C Driver does not check the result of an… CWE-476
- CVE-2026-120758 HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect()… CWE-476
- CVE-2026-43603 A NULL pointer dereference in the Linux GPU driver could potentially lead to a kernel… CWE-476
- CVE-2026-121402 FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows… CWE-476
- CVE-2026-121401 FreeRDP before 3.32.2 contains a denial of service vulnerability where rdg_process_packet… CWE-476
- CVE-2026-115403 In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket… CWE-476
- CVE-2026-114408 In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6… CWE-476