Elasticsearch 8.x < 8.19.20 / 9.0.x < 9.4.5 / 9.5.x < 9.5.1 Multiple Vulnerabilities (ESA-2026-78 / ESA-2026-79 / ESA-2026-116)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.20, or 9.0.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-78, ESA-2026-79, and ESA-2026-116 advisories. - Memory Allocation with Excessiv...

Elasticsearch 8.19.x < 8.19.20 / 9.3.x / 9.4.x < 9.4.5 / 9.5.x < 9.5.1 DoS (ESA-2026-120)

The version of Elasticsearch installed on the remote host is 8.19.x prior to 8.19.20, or 9.3.x or 9.4.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-120 advisory. - Elasticsearch does not enforce an upper bound on a...

EUVD-2026-46433

Reachable Assertion CWE-617 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153. A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats...

CVE-2026-63140

CVE-2026-63140 describes a Reachable Assertion (CWE-617) in Elasticsearch that can cause denial of service. A specially crafted search containing a null value in a specific query clause triggers an internal assertion during query parsing, which Elasticsearch treats as a fatal error and terminates...

CVE-2026-63140 Reachable Assertion in Elasticsearch Leading to Denial of Service

Reachable Assertion CWE-617 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153. A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats...

PT-2026-62116

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description An issue exists where a specially crafted search request containing a null value in a specific query clause triggers an internal assertion during query parsing. Since assertion failures...

CVE-2026-59892

OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx- HTTP header values with decodeURIComponent without handling decode errors, allowing an unauthenticated remote attacker to send a malformed...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, terraform-provider-acme-fips, docker-compose-fips, cluster-api-provider-vsphere, crossplane-provider-aws-s3, k8s-image-swapper, k8sgpt, temporal-server, vault-secrets-operator, cadence-fips, crossplane-provider-aws-ecs, velero, tkn,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, terraform-provider-acme-fips, docker-compose-fips, cluster-api-provider-vsphere, crossplane-provider-aws-s3, k8s-image-swapper, k8sgpt, temporal-server, vault-secrets-operator, cadence-fips, crossplane-provider-aws-ecs, velero, tkn,...

CVE-2026-33814 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-ui, thanos, cilium-cli, polaris, trino, fluxcd-kustomize-mutating-webhook, azcopy, mattermost, fuse-overlayfs-snapshotter, kiali, timestamp-authority, grafana-rollout-operator, temporal-server, crane, kubernetes-dashboard-metrics-scraper,...

CVE-2026-33814 vulnerabilities

Vulnerabilities for packages: temporal-server, chainloop-control-plane, crossplane-provider-aws-cognitoidentity-fips, hubble, ucd, local-path-provisioner-fips, cloudprober-fips, eck-operator-fips, kube-bench-fips, nri-couchbase-fips, rook, cert-manager-cmctl, mongodb-kubernetes-operator-fips, k3s...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: kubevela, eksctl, tigera-operator, falcoctl, hubble, rancher-agent, trivy, cilium-cli, datadog-agent, zarf, k3s, percona-server-mongodb-operator, headlamp, cilium, cert-manager-istio-csr, infinispan-operator, kpt, aws-node-termination-handler, kubernetes-dashboard-ap...

CVE-2026-35469 vulnerabilities

Vulnerabilities for packages: kubevela, eksctl, tigera-operator, falcoctl, hubble, rancher-agent, trivy, cilium-cli, datadog-agent, zarf, k3s, percona-server-mongodb-operator, headlamp, cilium, cert-manager-istio-csr, infinispan-operator, kpt, aws-node-termination-handler, kubernetes-dashboard-ap...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: cue, kyverno-policy-reporter-ui, cilium-cli, prometheus-pushgateway, gh, kubernetes-ingress-defaultbackend, polaris, cluster-api-provider-vsphere, buildah, docker-machine-driver-linode, fluxcd-kustomize-mutating-webhook, dataplaneapi, mattermost,...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: cloud-provider-vsphere, cloudprober, flux-kustomize-controller, prometheus-adapter, step-ca, secrets-store-csi-driver-provider-gcp, thanos, apisix-ingress-controller, kube-metrics-adapter, seaweedfs, spire-server, crossplane-provider-aws-sns, go-discover, dagdotdev,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: cloud-provider-vsphere, cloudprober, flux-kustomize-controller, prometheus-adapter, step-ca, secrets-store-csi-driver-provider-gcp, thanos, apisix-ingress-controller, kube-metrics-adapter, seaweedfs, spire-server, crossplane-provider-aws-sns, go-discover, dagdotdev,...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, commercial-chainloop-backend, cluster-api-provider-vsphere, crossplane-provider-aws-s3, docker-compose-fips, chainloop-control-plane, k8s-image-swapper, k8sgpt, rabbitmq-cluster-operator-fips, temporal-server, cadence-fips, velero, tkn,...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: cue, render-template, kyverno-policy-reporter-ui, prometheus-pushgateway, cluster-api-provider-vsphere, docker-machine-driver-linode, dataplaneapi, kiali, timestamp-authority, vt-cli, crane, chart-testing, kubernetes-dashboard-metrics-scraper,...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: kafka-proxy, ip-masq-agent, cloud-provider-vsphere, kubecolor, render-template, falco-exporter, ctop, neuvector-dbgen, prometheus-adapter, terraform-provider-sendgrid, trillian, secrets-store-csi-driver-provider-gcp, prometheus-pushgateway, apisix-ingress-controller,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: kafka-proxy, ip-masq-agent, cloud-provider-vsphere, kubecolor, render-template, falco-exporter, ctop, neuvector-dbgen, prometheus-adapter, terraform-provider-sendgrid, trillian, secrets-store-csi-driver-provider-gcp, prometheus-pushgateway, apisix-ingress-controller,...