EL
Database
Elasticsearch
On CISA KEVExploited in the wild
95
CVEs
2
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 2High 24Medium 65Low 1
Watch
Add Elasticsearch to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-22137 | 5.3 | May 13 | In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used Affected: before 6.8.15; 7.11.0 before 7.11.2 |
| CVE-2021-22135 | 5.3 | May 13 | Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security… Affected: before 6.8.15; 7.11.0 before 7.11.2 |
| CVE-2019-7619 | 5.3 | Oct 30 | Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service Affected: 6.7.0 through 6.8.3; 7.0.0 through 7.3.2 |
| CVE-2026-94408 | 4.9 | Sep 26 | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Affected: 8.0.0 through 8.19.21; 9.0.0 through 9.4.6; 9.5.0 through 9.5.2 |
| CVE-2026-56143 | 4.9 | Sep 1 | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service Affected: 8.0.0 through 8.19.19; 9.0.0 through 9.2.8 |
| CVE-2026-56149 | 4.9 | Jul 1 | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service Affected: 9.4.0 through 9.4.2; 9.0.0 through 9.3.5; 8.0.0 through 8.19.16 |
| CVE-2025-68390 | 4.9 | Dec 18 | Elasticsearch Allocation of Resources Without Limits or Throttling Affected: 7.0.0 through 7.17.29; 8.0.0 through 8.19.7; 9.0.0 through 9.1.7; 9.2.0 through 9.2.1 |
| CVE-2024-37280 | 4.9 | Jun 13 | Elasticsearch StackOverflow vulnerability Affected: 8.13.1 through 8.13.4 |
| CVE-2020-7021 | 4.9 | Feb 10 | Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled Affected: before 6.8.14; 7.0.0 before 7.10.0 |
| CVE-2021-22132 | 4.8 | Jan 14 | Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API Affected: 7.7.0 before 7.10.2 |
| CVE-2023-31417 | 4.4 | Oct 26 | Elasticsearch Insertion of sensitive information in audit logs Affected: 7.0.0 before 7.17.12; 8.0.0 before 8.9.1 |
| CVE-2026-102408 | 4.3 | Oct 6 | Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service Affected: 8.19.0 through 8.19.21; 9.1.0 through 9.3.8; 9.4.0 through 9.4.7; 9.5.0 through 9.5.4 |
| CVE-2026-72685 | 4.3 | Aug 13 | Inefficient Algorithmic Complexity in Elasticsearch Leading to Denial of Service Affected: 8.0.0 through 8.19.19; 9.0.0 through 9.4.4 |
| CVE-2022-23708 | 4.3 | Mar 3 | A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index,… Affected: 7.16.0 before 7.17.1 |
| CVE-2021-22134 | 4.3 | Mar 8 | A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used Affected: 7.6.0 through 7.11.0 |