Elasticsearch 8.x < 8.19.19 / 9.0.x < 9.3.8 / 9.4.x < 9.4.4 Multiple Vulnerabilities (ESA-2026-64 / ESA-2026-68 / ESA-2026-74)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.19, or 9.0.x prior to 9.3.8, or 9.4.x prior to 9.4.4. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-64, ESA-2026-68, and ESA-2026-74 advisories. - Reachable Assertion CWE-617 in...

Elasticsearch 8.x < 8.19.18 / 9.0.x < 9.3.7 / 9.4.x < 9.4.4 Multiple Vulnerabilities (ESA-2026-56 / ESA-2026-57)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.18, or 9.0.x prior to 9.3.7, 9.4.x prior to or 9.4.4. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-56 and ESA-2026-57 advisories. - Uncontrolled Resource Consumption CWE-400 in...

EUVD-2026-47591

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197. An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource...

EUVD-2026-47583

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch que...

CVE-2026-63263

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197. An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource...

CVE-2026-63144

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch que...

CVE-2026-63263 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197. An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource...

CVE-2026-63263

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197. An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource...

CVE-2026-63263 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197. An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource...

CVE-2026-63263

CVE-2026-63263 affects Elasticsearch’s ES|QL engine, where an authenticated user can submit a crafted query that triggers exponential CPU consumption during evaluation, causing uncontrolled resource exhaustion. The impact is denial of service as query worker resources become exhausted and ES|QL q...

Elasticsearch 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-74)

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197. An authenticated user may submit a specially crafted query to the ES|QL engine that...

CVE-2026-63144

Summary (CVE-2026-63144): An uncontrolled recursion (CWE-674) in Elasticsearch’s query evaluation can cause a denial of service. A low-privilege authenticated user with read-level index access can submit a crafted search request that triggers unbounded recursive processing, leading to a fatal err...

CVE-2026-63144 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch que...

CVE-2026-63144

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch que...

CVE-2026-63144 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch que...

Elasticsearch 8.19.19, 9.3.8, 9.4.4 Security Update (ESA-2026-68)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that...

EUVD-2026-46404

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and...

EUVD-2026-46433

Reachable Assertion CWE-617 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153. A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats...

EUVD-2026-46395

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user with permission to execute EQL sequence queries against an index they control can send a specially crafted query that triggers excessive...

EUVD-2026-46389

Incorrect Authorization CWE-863 in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By targeting indices they are not authorized to access directly, the user can cause those indices'...