Elasticsearch 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-196)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursio...

GHSA-W67G-5RQW-F597 vulnerabilities

Vulnerabilities for packages: verticadb-operator, guac, cloudflared, infinispan-operator, kubevela, etcd, rancher-telemetry, juicefs-csi-driver, aws-node-termination-handler, kubernetes, amazon-cloudwatch-agent, emissary, op-geth, jitsucom-bulker, redis-operator...

Elasticsearch 8.19.x < 8.19.20 / 9.3.x / 9.4.x < 9.4.5 / 9.5.x < 9.5.1 DoS (ESA-2026-120)

The version of Elasticsearch installed on the remote host is 8.19.x prior to 8.19.20, or 9.3.x or 9.4.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-120 advisory. - Elasticsearch does not enforce an upper bound on a...

Elasticsearch 8.x < 8.19.20 / 9.0.x < 9.4.5 / 9.5.x < 9.5.1 Multiple Vulnerabilities (ESA-2026-78 / ESA-2026-79 / ESA-2026-116)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.20, or 9.0.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-78, ESA-2026-79, and ESA-2026-116 advisories. - Memory Allocation with Excessiv...

BIT-ELASTICSEARCH-2026-72684 Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the...

CVE-2026-72639 Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service

Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker. An authenticated user holding only read privileges on a single searchable index can submit one...

CVE-2026-72686 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value being validated, so the validation...

CVE-2026-72686 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value being validated, so the validation...

CVE-2026-72683 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ingest-simulate to submit a request that causes a self-referential data structure to be created. Whe...

Uncontrolled Recursion

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Uncontrolled Recursion via the query evaluation. An attacker can cause the affected node to terminate by submitting a specially...

EUVD-2026-46433

Reachable Assertion CWE-617 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153. A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats...

CVE-2026-63140 Reachable Assertion in Elasticsearch Leading to Denial of Service

Reachable Assertion CWE-617 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153. A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats...

CVE-2026-63140

CVE-2026-63140 describes a Reachable Assertion (CWE-617) in Elasticsearch that can cause denial of service. A specially crafted search containing a null value in a specific query clause triggers an internal assertion during query parsing, which Elasticsearch treats as a fatal error and terminates...

PT-2026-62116

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description An issue exists where a specially crafted search request containing a null value in a specific query clause triggers an internal assertion during query parsing. Since assertion failures...

CVE-2026-59892

OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx- HTTP header values with decodeURIComponent without handling decode errors, allowing an unauthenticated remote attacker to send a malformed...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: tempo, rke2-cloud-provider-fips, cerbos-fips, rancher-fleet-fips, calico-fips, terraform, opencost, external-dns-fips, terraform-provider-acme-fips, kserve-localmodelnode-agent-fips, k8s-agents-operator, crossplane-provider-azure-servicefabric,...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: tempo, rke2-cloud-provider-fips, cerbos-fips, rancher-fleet-fips, calico-fips, terraform, opencost, external-dns-fips, terraform-provider-acme-fips, kserve-localmodelnode-agent-fips, k8s-agents-operator, crossplane-provider-azure-servicefabric,...

CVE-2026-33814 vulnerabilities

Vulnerabilities for packages: act, undock, minio-operator, fuse-overlayfs-snapshotter, kwok, polaris, sftpgo, terraform-provider-acme, velero-plugin-for-microsoft-azure, kor, witness, step-kms-plugin, q, argocd-image-updater, kube-vip, rancher-system-upgrade-controller, controller-gen,...

CVE-2026-33814 vulnerabilities

Vulnerabilities for packages: cerbos-fips, pluto-fips, terraform, kserve-localmodelnode-agent-fips, k8s-agents-operator, dex, argo-workflows-fips, crossplane-provider-aws-efs, opentofu, crossplane-provider-aws-vpc-fips, longhorn-cli, mlrun-log-collector-fips, go-openssl, boring-registry,...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: kots, trivy-operator, verticadb-operator, docker-cli-buildx, envoy-gateway, kubevela, percona-server-mongodb-operator, kpt, cilium, juicefs-csi-driver, argo-rollouts, kubernetes, k8sgpt-operator, infinispan-operator, kubeflow-pipelines, kwok, teleport, redis-operator...