CVE-2026-72685

A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, degrading the...

CVE-2026-72685 Inefficient Algorithmic Complexity in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, degrading the...

CVE-2026-72684 Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the...

CVE-2026-72684

This CVE affects Elasticsearch where an authenticated user with read privileges can trigger memory allocation by sending a crafted small search input, leading to an out-of-memory fatal condition and node denial of service. Affected versions: 8.0.0–8.19.19 and 9.0.0–9.4.4. Mitigation: upgrade to v...

EUVD-2026-58248

A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the...

CVE-2026-72684

A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the...

CVE-2026-72683 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ingest-simulate to submit a request that causes a self-referential data structure to be created. Whe...

CVE-2026-72683

The CVE-2026-72683 issue affects Elasticsearch where an authenticated user able to call the simulate pipeline API can submit a request that creates a self-referential data structure. When processed by an internal component, the operation recurses without bound, causing a fatal error that terminat...

CVE-2026-72683

A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ingest-simulate to submit a request that causes a self-referential data structure to be created. Whe...

EUVD-2026-58247

A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ingest-simulate to submit a request that causes a self-referential data structure to be created. Whe...

CVE-2026-49089

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana proces...

CVE-2026-49089 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana proces...

CVE-2026-49089

CVE-2026-49089 reflects an issue in Kibana where a query expression accepted by a connector could be processed without size limits, allowing an authenticated read-only user to trigger a DoS by an oversized expression. The Elastic advisories describe the root cause as unbounded evaluation time for...

CVE-2026-49089 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana proces...

EUVD-2026-58244

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana proces...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime through DnsCodecUtil.decompressDomainName in codec-dns/src/main/java/io/netty/handler/codec/dns/DnsCodecUtil.java. An attacker can exhaust direct memory and trigger a gradual denial o...

CVE-2026-19745

A flaw has been found in Calix GigaSpire 26.1.0. Impacted is an unknown function of the file utilitiesconfigurationsave.cgi of the component Web Management Interface. Executing a manipulation of the argument sessionKey can lead to denial of service. The attack can be launched remotely. The exploi...

CVE-2026-19745 Calix GigaSpire Web Management utilities_configurationsave.cgi denial of service

A flaw has been found in Calix GigaSpire 26.1.0. Impacted is an unknown function of the file utilitiesconfigurationsave.cgi of the component Web Management Interface. Executing a manipulation of the argument sessionKey can lead to denial of service. The attack can be launched remotely. The exploi...

CVE-2026-19745

Technical details for CVE-2026-19745 are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-58241

A flaw has been found in Calix GigaSpire 26.1.0. Impacted is an unknown function of the file utilitiesconfigurationsave.cgi of the component Web Management Interface. Executing a manipulation of the argument sessionKey can lead to denial of service. The attack can be launched remotely. The exploi...