CVE-2026-56145 vulnerabilities

Vulnerabilities for packages: ruby3.3-elasticsearch, ruby3.4-elasticsearch, ruby4.0-elasticsearch, ruby3.2-elasticsearch...

CVE-2026-63140 vulnerabilities

Vulnerabilities for packages: ruby3.3-elasticsearch, ruby3.4-elasticsearch, ruby4.0-elasticsearch, ruby3.2-elasticsearch...

GHSA-727X-48VV-8CJ7 vulnerabilities

Vulnerabilities for packages: ruby3.3-elasticsearch, ruby3.4-elasticsearch, ruby4.0-elasticsearch, ruby3.2-elasticsearch...

GHSA-9FHM-53XW-H9C3 vulnerabilities

Vulnerabilities for packages: ruby3.3-elasticsearch, ruby3.4-elasticsearch, ruby4.0-elasticsearch, ruby3.2-elasticsearch...

CVE-2026-63263 vulnerabilities

Vulnerabilities for packages: ruby3.3-elasticsearch, ruby3.4-elasticsearch, ruby4.0-elasticsearch, ruby3.2-elasticsearch...

GHSA-93WV-JW9V-4972 vulnerabilities

Vulnerabilities for packages: tinkerpop, zipkin, kayenta-fips, celeborn, elasticsearch, kafbat-ui-fips, opensearch-fips, spark-fips, keycloak, spark-kubernetes-operator-fips, hadoop-fips, druid, apache-camel-karavan-devmode, opensearch, keycloak-fips, elasticsearch-fips, metabase, spark,...

CVE-2026-56819 vulnerabilities

Vulnerabilities for packages: tinkerpop, zipkin, kayenta-fips, celeborn, elasticsearch, kafbat-ui-fips, opensearch-fips, spark-fips, keycloak, spark-kubernetes-operator-fips, hadoop-fips, druid, apache-camel-karavan-devmode, opensearch, keycloak-fips, elasticsearch-fips, metabase, spark,...

CLEANSTART-2026-FT57880 Security fixes in elasticsearch 9.2.8-r0

Package elasticsearch version 9.2.8-r0 fixes 18 vulnerabilities: CVE-2026-54399, CVE-2026-54428, CVE-2026-41715, CVE-2026-42579, CVE-2026-45536...

CLEANSTART-2026-SD03557 Security fixes in elasticsearch 9.2.8-r2

Package elasticsearch version 9.2.8-r2 fixes 6 vulnerabilities: CVE-2025-68161, CVE-2026-34477, CVE-2026-34478, CVE-2026-34480, CVE-2026-34479...

CLEANSTART-2026-JU04978 Security fixes in prometheus-elasticsearch-exporter 1.10.0-r0

Package prometheus-elasticsearch-exporter version 1.10.0-r0 fixes 2 vulnerabilities: CVE-2025-68121, CVE-2025-61732...

CLEANSTART-2026-QJ84375 Security fixes in prometheus-elasticsearch-exporter 1.10.0-r1

Package prometheus-elasticsearch-exporter version 1.10.0-r1 fixes 3 vulnerabilities: CVE-2026-25679, CVE-2026-27139, CVE-2026-27142...

CLEANSTART-2026-JK70827 Security fixes in elasticsearch 9.3.7-r1

Package elasticsearch version 9.3.7-r1 fixes 5 vulnerabilities: CVE-2026-54399, CVE-2026-54428, CVE-2026-41715, CVE-2026-42579, CVE-2026-45536...

CLEANSTART-2026-ZH81233 Security fixes in elasticsearch 9.4.3-r1

Package elasticsearch version 9.4.3-r1 fixes 7 vulnerabilities: ghsa-72hv-8253-57qq, CVE-2026-59949, CVE-2026-54399, CVE-2026-54428, CVE-2026-41715...

CLEANSTART-2026-JC40207 Security fixes in prometheus-elasticsearch-exporter-fips 1.10.0-r0

Package prometheus-elasticsearch-exporter-fips version 1.10.0-r0 fixes 2 vulnerabilities: CVE-2025-68121, CVE-2025-61732...

BIT-ELASTICSEARCH-2026-63263 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197. An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource...

BIT-ELASTICSEARCH-2026-63144 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch que...

BIT-ELASTICSEARCH-2026-63136 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and...

BIT-ELASTICSEARCH-2026-56145 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user with permission to execute EQL sequence queries against an index they control can send a specially crafted query that triggers excessive...

BIT-ELASTICSEARCH-2026-56144 Incorrect Authorization in Elasticsearch Leading to Information Disclosure

Incorrect Authorization CWE-863 in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By targeting indices they are not authorized to access directly, the user can cause those indices'...

Elasticsearch 8.x < 8.19.15 / 9.0.x < 9.2.9 / 9.3.x < 9.3.4 DoS (ESA-2026-60)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.15, or 9.0.x prior to 9.2.9, or 9.3.x prior to 9.3.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-60 advisory. - Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to...