Elasticsearch

Elasticsearch Wildcard Matching Recursion Overflow Enables DoS
CVE-2026-72636 6.5 - Medium - August 13, 2026

Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of match operations performed. A search request containing a wildcard pattern with a large number of wildcard groups, evaluated against a sufficiently long name, exhausts the thread stack. Elasticsearch treats a stack overflow as an unrecoverable condition and shuts the node down, so the request terminates the affected node rather than failing gracefully.

Stack Exhaustion

Elasticsearch ML Inference Heap Corruption via Offset Overflow
CVE-2026-72642 8.8 - High - August 13, 2026

The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with the privileges required to upload and deploy a trained model can craft a model that reads and writes memory outside the intended allocation. The result is heap corruption that crashes the inference process, and, with sufficient control over the heap layout, could allow arbitrary code execution in the context of that process.

Untrusted pointer offset

Elasticsearch Highlighting OOM DoS via Counting Bug
CVE-2026-72639 6.5 - Medium - August 13, 2026

Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker. An authenticated user holding only read privileges on a single searchable index can submit one small search request that causes the node to reserve an excessively large internal data structure. The allocation occurs before the existing highlighting safety limits are evaluated, so memory exhaustion raises a fatal error that terminates the Elasticsearch node process. This results in a denial of service for the affected node and degrades cluster routing and health. The defect is not volumetric and does not depend on the size of the indexed data, so a single request is sufficient.

Stack Exhaustion

Elasticsearch Recursion DoS via Custom Analysis
CVE-2026-72638 6.5 - Medium - August 13, 2026

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that is resolved recursively without a cycle or depth check, exhausting the thread stack and terminating the affected node.

Stack Exhaustion

Elasticsearch Uncontrolled Recursion: Read-Only Authenticated Read Denial
CVE-2026-72647 6.5 - Medium - August 13, 2026

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without a depth limit, exhausting the thread stack and terminating the affected node.

Stack Exhaustion

Excessive Size Memory Allocation in Elasticsearch Leads to DoS (CWE-789)
CVE-2026-72645 6.5 - Medium - August 13, 2026

Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only read privileges on a single index can submit one small, specially crafted search request that causes an excessively large memory allocation, exhausting the JVM heap and terminating the affected node.

Stack Exhaustion

Elasticsearch ES|QL Excessive Heap Allocation DoS
CVE-2026-72656 6.5 - Medium - August 13, 2026

Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user able to submit ES|QL queries could send a specially crafted query whose evaluation allocates an unbounded amount of heap memory, exhausting the available heap on the receiving node and causing the node to become unavailable.

Stack Exhaustion

Elasticsearch DoS via Unbounded Recursion (Intervals Query)
CVE-2026-72679 6.5 - Medium - August 13, 2026

Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that exhausts the thread stack and raises a fatal error, terminating the Elasticsearch node process and causing a denial of service for that node. An authenticated user holding only read-only privileges on a single searchable index can trigger the condition with one small search request.

Stack Exhaustion

Elasticsearch Memory Exhaustion via Unvalidated Size Parameter
CVE-2026-72678 6.5 - Medium - August 13, 2026

Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product API endpoint that causes the node to attempt an excessively large allocation. The resulting memory exhaustion raises a fatal error that terminates the Elasticsearch node process, causing a denial of service for the affected node and degrading cluster health. The defect is not volumetric, so a single request is sufficient regardless of the heap size configured on the target node.

Stack Exhaustion

Elasticsearch OOM via Forged Opaque ID allows DoS
CVE-2026-72687 6.5 - Medium - August 13, 2026

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carried inside the identifier drives an allocation that is neither capped nor accounted for by the available memory-usage controls. The resulting out-of-memory condition is fatal and terminates the affected node process, resulting in a denial of service.

Stack Exhaustion

Elasticsearch NoBound Recursion Causing Thread Stack Exhaustion (DoS)
CVE-2026-72686 6.5 - Medium - August 13, 2026

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value being validated, so the validation causes the thread to exhaust its stack. The resulting fatal error is not handled by the surrounding execution paths and terminates the affected node process, producing a denial of service.

Stack Exhaustion

Elasticsearch DOS via Crafted Index Document
CVE-2026-72685 4.3 - Medium - August 13, 2026

A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, degrading the availability of indexing operations on the affected node.

Inefficient Algorithmic Complexity

Elasticsearch OOM via crafted search request from read creds
CVE-2026-72684 6.5 - Medium - August 13, 2026

A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the scope of the existing memory accounting controls that were intended to constrain it. The resulting out-of-memory condition is fatal and terminates the affected node process, causing a denial of service.

Allocation of Resources Without Limits or Throttling

ElasticSearch Simulate Pipeline Recursion DoS via Self-Referential JSON
CVE-2026-72683 6.5 - Medium - August 13, 2026

A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ingest-simulate) to submit a request that causes a self-referential data structure to be created. When a specific internal component later processes that structure, the operation recurses without bound and raises a fatal error that is not handled by the surrounding execution path, terminating the affected node process and resulting in a denial of service.

Stack Exhaustion

Elasticsearch ES|QL CPU Exhaustion via Exponential Data Expansion
CVE-2026-63263 6.5 - Medium - July 21, 2026

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource exhaustion persists beyond query completion, repeated requests can fully exhaust the available query worker resources, rendering ES|QL queries unavailable until the node is restarted.

Resource Exhaustion

Elasticsearch Recursion DoS via Malicious Query (CVE-2026-63144)
CVE-2026-63144 6.5 - Medium - July 21, 2026

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch query evaluation component, causing a fatal error that terminates the affected node. In single-node deployments, this results in complete service outage; in multi-node clusters, it causes repeated node restarts and sustained availability degradation.

Stack Exhaustion

Elasticsearch DoS via Assertion Failure in Query Parsing
CVE-2026-63140 6.5 - Medium - July 21, 2026

Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats assertion failures as fatal errors, this terminates the affected node process. A low-privileged authenticated user with read access to at least one index can exploit this condition with a single request to cause a node to terminate, disrupting search availability. In a single-node deployment this fully stops Elasticsearch; in a multi-node cluster it reduces cluster capacity for each affected node.

assertion failure

Elasticsearch CVE-2026-63136: Uncontrolled Resource Consumption (CWE-400)
CVE-2026-63136 6.5 - Medium - July 21, 2026

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and cluster degradation. An attacker could leverage this vulnerability to cause cluster downtime requiring manual intervention to restore service.

Resource Exhaustion

Elasticsearch Uncontrolled Resource Consumption via EQL Query
CVE-2026-56145 6.5 - Medium - July 21, 2026

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL sequence queries against an index they control can send a specially crafted query that triggers excessive memory consumption, causing the Elasticsearch node to crash.

Resource Exhaustion

Elasticsearch Ingest Simulation Auth Bypass (CWE-863)
CVE-2026-56144 5.3 - Medium - July 21, 2026

Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By targeting indices they are not authorized to access directly, the user can cause those indices' configured ingest pipelines to execute and return their output, potentially disclosing data processed or enriched by those pipelines. Additionally, the same feature can be used to retrieve index mapping metadata for indices the user are not authorized to access directly.

AuthZ

Uncontrolled Resource Consumption in Elasticsearch Bulk Request
CVE-2026-49090 6.5 - Medium - July 01, 2026

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk request that causes sustained high CPU consumption, which can render the affected node unable to process requests.

Resource Exhaustion

Elasticsearch ML Request DOS via CVE-2026-56149 (CWE-770)
CVE-2026-56149 4.9 - Medium - July 01, 2026

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a specially crafted machine learning request that causes excessive memory consumption, which may render the affected node unavailable.

Allocation of Resources Without Limits or Throttling

Elasticsearch Uncontrolled Recursion CVE-2026-56148 (Denial of Service)
CVE-2026-56148 6.5 - Medium - July 01, 2026

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excessive resource consumption while the request is processed, which may render the affected node unavailable.

Stack Exhaustion

Elasticsearch Excessive Memory Allocation via Snapshot Restore (DoS)
CVE-2025-68390 4.9 - Medium - December 18, 2025

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory and a denial of service (DoS) via crafted HTTP request.

Allocation of Resources Without Limits or Throttling

Elasticsearch OOM DoS: Unrestricted User Settings Allocation
CVE-2025-68384 6.5 - Medium - December 18, 2025

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.

Allocation of Resources Without Limits or Throttling

Elasticsearch PKI Realm Improper Auth Leads to User Impersonation
CVE-2025-37731 6.8 - Medium - December 15, 2025

Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.

authentification

Elasticsearch: Sensitive Data Log Logging via reindex API (CVE-2025-37727)
CVE-2025-37727 5.7 - Medium - October 10, 2025

Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex

Insertion of Sensitive Information into Log File

Elasticsearch DoS via Uncontrolled Resource Consumption in Mustache Templates
CVE-2024-52979 - May 01, 2025

Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.

Elasticsearch PatternBank Recursion Crash Exploitable with read_pipeline
CVE-2024-52980 - April 08, 2025

A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elasticsearch node to crash. A successful attack requires a malicious user to have read_pipeline Elasticsearch cluster privilege assigned to them.

Elasticsearch stack overflow via recursive GeometryCollection WKT
CVE-2024-52981 - April 08, 2025

An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.

ElasticSearch: Unbounded Resource Allocation via SQL Query OOM Crash
CVE-2024-43709 7.5 - High - January 21, 2025

An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function.

Allocation of Resources Without Limits or Throttling

Elasticsearch Improper Authorization Vulnerability in Document Level Security
CVE-2024-12539 6.5 - Medium - December 17, 2024

An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow.

AuthZ

Elastic Certutil CSR option writes private keys unencrypted
CVE-2024-23444 7.5 - High - July 31, 2024

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.

Missing Encryption of Sensitive Data

Elastic Elasticsearch 7.x/8.x Watcher Exposes Doc Content via DEBUG Log
CVE-2023-49921 6.5 - Medium - July 26, 2024

An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents stored in Elasticsearch to be printed in logs. Elastic has released 8.11.2 and 7.17.16 that resolves this issue by removing this excessive logging. This issue only affects users that use Watcher and have a Watch defined that uses the search input and additionally have set the search inputs logger to DEBUG or finer, for example using: org.elasticsearch.xpack.watcher.input.search, org.elasticsearch.xpack.watcher.input, org.elasticsearch.xpack.watcher, or wider, since the loggers are hierarchical.

Insertion of Sensitive Information into Log File

Elasticsearch StackOverflow DoS via passthrough dynamic field mapping
CVE-2024-37280 4.9 - Medium - June 13, 2024

A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of passthrough type. Under certain circumstances, ingesting documents in this index would cause a StackOverflow exception to be thrown and ultimately lead to a Denial of Service. Note that passthrough fields is an experimental feature.

Memory Corruption

Elastic Elasticsearch 8.14.0: Cross-Cluster API Key Search Restrictions Bypass
CVE-2024-23445 - June 12, 2024

It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/reference/8.14/security-api-create-cross-cluster-api-key.html#security-api-create-cross-cluster-api-key-request-body  restricts search for a given index using the query or the field_security parameter, and the same cross-cluster API key also grants replication for the same index, the search restrictions are not enforced during cross cluster search operations and search results may include documents and terms that should not be returned. This issue only affects the API key based security model for remote clusters https://www.elastic.co/guide/en/elasticsearch/reference/8.14/remote-clusters.html#remote-clusters-security-models  that was previously a beta feature and is released as GA with 8.14.0

Uncaught Exception in Elastic Elasticsearch 8.48.11.1 (Encrypted PDF Crash)
CVE-2024-23449 5.3 - Medium - March 29, 2024

An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files.

Elasticsearch 8.10.0-8.12.x RemClstSec API-Key Indx Read (Beta)
CVE-2024-23451 6.5 - Medium - March 27, 2024

Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elasticsearch 8.10.0 and before 8.13.0. This allows a malicious user with a valid API key for a remote cluster configured to use the new Remote Cluster Security to read arbitrary documents from any index on the remote cluster, and only if they use the Elasticsearch custom transport protocol to issue requests with the target index ID, the shard ID and the document ID. None of Elasticsearch REST API endpoints are affected by this issue.

AuthZ

Elasticsearch Node Crash via Deeply Nested Pipeline (CVE-2024-23450)
CVE-2024-23450 7.5 - High - March 27, 2024

A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.

Elastic Detection Engine Search API Bypasses DLS/FLS on .alerts-security.indices
CVE-2024-23446 6.5 - Medium - February 07, 2024

An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{space_id} indices. Users who are authorized to call this API may obtain unauthorized access to documents if their roles are configured with DLS or FLS against the aforementioned index.

Elastic unsafe deserialization via Hadoop/Spark config
CVE-2023-46674 7.8 - High - December 05, 2023

An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.

Marshaling, Unmarshaling

Elasticsearch Ingest Pipeline Script Processor Crash via Malformed Scripts
CVE-2023-46673 7.5 - High - November 22, 2023

It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API.

Improper Handling of Exceptional Conditions

Elastic Fleet API Key Escalation via Service Account
CVE-2021-37937 8.8 - High - November 22, 2023

An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compromised Fleet-Server service account could escalate themselves to a super-user.

ES: Sensitive Data Leaked to Audit Logs via Deprecated API URIs
CVE-2023-31417 4.4 - Medium - October 26, 2023

Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. The impact of this flaw is that sensitive information such as passwords and tokens might be printed in cleartext in Elasticsearch audit logs. Note that audit logging is disabled by default and needs to be explicitly enabled and even when audit logging is enabled, request bodies that could contain sensitive information are not printed to the audit log unless explicitly configured.

Insertion of Sensitive Information into Log File

Unauthorized OOM via Malformed HTTP Requests in Elasticsearch
CVE-2023-31418 7.5 - High - October 26, 2023

An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was identified by Elastic Engineering and we have no indication that the issue is known or that it is being exploited in the wild.

Resource Exhaustion

Elasticsearch _search API Stack Overflow DoS via Crafted Query
CVE-2023-31419 7.5 - High - October 26, 2023

A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.

Memory Corruption

A Denial of Service flaw was discovered in Elasticsearch
CVE-2022-23712 7.5 - High - June 06, 2022

A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request.

A flaw was discovered in Elasticsearch 7.17.0s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index
CVE-2022-23708 4.3 - Medium - March 03, 2022

A flaw was discovered in Elasticsearch 7.17.0s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with * index permissions access to this index.

Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots
CVE-2021-22147 6.5 - Medium - September 15, 2021

Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view.

AuthZ

In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability
CVE-2021-22144 6.5 - Medium - July 26, 2021

In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.

Stack Exhaustion