Elastic Elasticsearch vulnerabilities

CVE-2018-3827 [HIGH] CWE-532 CVE-2018-3827: A sensitive data disclosure flaw was found in the Elasticsearch repository-azure (formerly elasticse A sensitive data disclosure flaw was found in the Elasticsearch repository-azure (formerly elasticsearch-cloud-azure) plugin. When the repository-azure plugin is set to log at TRACE level Azure credentials can be inadvertently logged.

CVE-2024-23450 [HIGH] CWE-400 CVE-2024-23450: A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on a A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.

CVE-2026-63263 [MEDIUM] CWE-400 CVE-2026-63263: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Expon Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource exhaustion persists beyond query completion, repeat

CVE-2026-56145 [MEDIUM] CWE-400 CVE-2026-56145: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exces Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL sequence queries against an index they control can send a specially crafted query that triggers excessive memory consumption, causing the Elasticsearch nod

CVE-2023-49921 [MEDIUM] CWE-532 CVE-2023-49921: An issue was discovered by Elastic whereby Watcher search input logged the search query results on D An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Wat

CVE-2026-72638 [MEDIUM] CWE-674 CVE-2026-72638: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manip Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that is resolved recursively without a cycle or depth ch

CVE-2026-63144 [MEDIUM] CWE-674 CVE-2026-63144: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially craf Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch query evaluation component, causing a fatal error that

CVE-2026-102404 [MEDIUM] CWE-400 CVE-2026-102404: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exces Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted query that causes uncontrolled memory growth in the query processing engine, resulting in an out-of-memory condition that terminates the Elasticsearch no

CVE-2024-52979 [HIGH] CWE-400 CVE-2024-52979: Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search temp Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.

CVE-2024-52981 [HIGH] CWE-400 CVE-2024-52981: An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.

CVE-2020-7019 [MEDIUM] CWE-270 CVE-2020-7019: In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a user runs the same query another more privileged user recently ran, the scrolling search can leak fields that should be hidden. This could result in an attacker gaining additional permissions against a restricted in

CVE-2026-72679 [MEDIUM] CWE-674 CVE-2026-72679: Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern ac Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that exhausts the thread stack and raises a fatal error, terminating the Elasticsearch node process and causing a denial of service for that node. An authentica

CVE-2026-72647 [MEDIUM] CWE-674 CVE-2026-72647: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without a depth limit, exhausting the thread stack and ter

CVE-2026-72645 [MEDIUM] CWE-789 CVE-2026-72645: Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only read privileges on a single index can submit one small, specially crafted search request that causes an excessively large memory allocation, exhausting the JVM heap and terminat

CVE-2026-63136 [MEDIUM] CWE-400 CVE-2026-63136: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exces Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and cluster degradation. An attacker could leverage thi

CVE-2021-22144 [MEDIUM] CWE-674 CVE-2021-22144: In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that coul In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.

CVE-2026-56148 [MEDIUM] CWE-674 CVE-2026-56148: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allo Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excessive resource consumption while the request is processed, which may render the affected node unavailable.

CVE-2026-72656 [MEDIUM] CWE-789 CVE-2026-72656: Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user able to submit ES|QL queries could send a specially crafted query whose evaluation allocates an unbounded amount of heap memory, exhausting the available heap o

CVE-2026-49090 [MEDIUM] CWE-400 CVE-2026-49090: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Exc Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk request that causes sustained high CPU consumption, which can render the affected node unable to process requests.

CVE-2026-102411 [MEDIUM] CWE-770 CVE-2026-102411: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial o Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template resource, but does not limit the total memory used when multiple such resources are retrieved togeth