CVE-2021-22145

A memory disclosure flaw was found in Elasticsearch’s error reporting. A user who can submit arbitrary queries to Elasticsearch could submit a malformed query that results in an error message returned that contains previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.