Null pointer dereference (CWE-476) in the AMQP protocol parser causes a Go runtime panic that terminates the Packetbeat process, disabling network telemetry on the monitored segment. This denial of service can be triggered by a single crafted packet; no AMQP authentication is required, and the attacker need only be able to send traffic on the segment that Packetbeat monitors.

Elastic Packetbeat is affected. The advisory does not list specific version numbers, so any instances using the AMQP protocol parser in the affected code base could be vulnerable. Administrators should verify the version of Packetbeat deployed and consult the vendor’s security release notes for the fix.

With a CVSS score of 6.5, the vulnerability presents moderate risk. EPSS is not available, and the issue is not yet in CISA KEV. Attacks would be conducted from the network side by sending malicious AMQP packets; an unauthenticated attacker can trigger the denial by sending a single crafted packet. Because the impact is service disruption and the extent is limited to the monitored segment, the risk depends on the criticality of that telemetry data for operational monitoring.