Elasticsearch 8.19.x < 8.19.20 / 9.3.x / 9.4.x < 9.4.5 / 9.5.x < 9.5.1 DoS (ESA-2026-120)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338343);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/20");

  script_cve_id("CVE-2026-72639");
  script_cwe_id(789);

  script_name(english:"Elasticsearch 8.19.x < 8.19.20 / 9.3.x / 9.4.x < 9.4.5 / 9.5.x < 9.5.1 DoS (ESA-2026-120)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Elasticsearch installed on the remote host is 8.19.x prior to 8.19.20, or 9.3.x or 9.4.x prior to 9.4.5,
or 9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-120 advisory.

  - Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting
    option, and the allocation derived from that count is not accounted against any circuit breaker. An
    authenticated user holding only read privileges on a single searchable index can submit one small search
    request that causes the node to reserve an excessively large internal data structure. The allocation occurs
    before the existing highlighting safety limits are evaluated, so memory exhaustion raises a fatal error that
    terminates the Elasticsearch node process. (CVE-2026-72639)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-120/389503
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0cea669e");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Elasticsearch version 8.19.20, 9.4.5, or 9.5.1 or later as appropriate for your release branch.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-72639");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/20");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:elasticsearch");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elastic:elasticsearch");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("elasticsearch_detect.nbin", "elastic_elasticsearch_nix_installed.nbin");
  script_require_keys("installed_sw/Elasticsearch");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'linux'}}
  ],
  'checks': [
    {
      'product': {'name': 'Elasticsearch', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '8.19.0', 'fixed_version': '8.19.20'},
        {'min_version': '9.3.0', 'fixed_version': '9.4.5'},
        {'min_version': '9.5.0', 'fixed_version': '9.5.1'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);