Elasticsearch 8.x < 8.19.20 / 9.0.x < 9.4.5 / 9.5.x < 9.5.1 Multiple Vulnerabilities (ESA-2026-78 / ESA-2026-79 / ESA-2026-116)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338338);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/20");

  script_cve_id("CVE-2026-72645", "CVE-2026-72686", "CVE-2026-72687");
  script_cwe_id(789, 674);

  script_name(english:"Elasticsearch 8.x < 8.19.20 / 9.0.x < 9.4.5 / 9.5.x < 9.5.1 Multiple Vulnerabilities (ESA-2026-78 / ESA-2026-79 / ESA-2026-116)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.20, or 9.0.x prior to 9.4.5, or 9.5.x
prior to 9.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-78, ESA-2026-79,
and ESA-2026-116 advisories.

  - Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via
    Excessive Allocation (CAPEC-130). An authenticated user holding only read privileges on a single index can
    submit one small, specially crafted search request that causes an excessively large memory allocation,
    exhausting the JVM heap and terminating the affected node. (CVE-2026-72645)

  - A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a
    crafted user-supplied input. A specific internal component validates the input using a recursive routine and
    applies no bound to the length of the value being validated, so the validation causes the thread to exhaust
    its stack. The resulting fatal error is not handled by the surrounding execution paths and terminates the
    affected node process, producing a denial of service. (CVE-2026-72686)

  - A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing
    a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it
    was legitimately issued by the cluster, and a size value carried inside the identifier drives an allocation
    that is neither capped nor accounted for by the available memory-usage controls. The resulting out-of-memory
    condition is fatal and terminates the affected node process, resulting in a denial of service.
    (CVE-2026-72687)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-78/389505
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?cf51803e");
  # https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-79/389506
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?73e6baac");
  # https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-116/389502
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?13e4a27e");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Elasticsearch version 8.19.20, 9.4.5, or 9.5.1 or later as appropriate for your release branch.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-72645");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/20");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:elasticsearch");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elastic:elasticsearch");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("elasticsearch_detect.nbin", "elastic_elasticsearch_nix_installed.nbin");
  script_require_keys("installed_sw/Elasticsearch");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'linux'}}
  ],
  'checks': [
    {
      'product': {'name': 'Elasticsearch', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '8.0.0', 'fixed_version': '8.19.20'},
        {'min_version': '9.0.0', 'fixed_version': '9.4.5'},
        {'min_version': '9.5.0', 'fixed_version': '9.5.1'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);