EL
Database
Elasticsearch
On CISA KEVExploited in the wild
95
CVEs
2
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 2High 24Medium 65Low 1
Watch
Add Elasticsearch to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-103008 | 6.5 | Oct 6 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Affected: 8.12.0 through 8.19.22; 9.0.0 through 9.4.7; 9.5.0 through 9.5.4 |
| CVE-2026-103006 | 6.5 | Oct 6 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Affected: 8.0.0 through 8.19.20; 9.0.0 through 9.4.5; 9.5.0 through 9.5.1 |
| CVE-2026-103005 | 6.5 | Oct 6 | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Affected: 8.12.0 through 8.19.22; 9.0.0 through 9.3.8; 9.4.0 through 9.4.7; 9.5.0 through 9.5.4 |
| CVE-2026-102411 | 6.5 | Oct 6 | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service Affected: 8.0.0 through 8.19.22; 9.0.0 through 9.4.6; 9.5.0 through 9.5.2 |
| CVE-2026-102409 | 6.5 | Oct 6 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Affected: 9.2.0 through 9.2.8; 9.3.0 through 9.3.8; 9.4.0 through 9.4.7; 9.5.0 through 9.5.4 |
| CVE-2026-102404 | 6.5 | Oct 6 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Affected: 8.0.0 through 8.19.22; 9.0.0 through 9.4.7; 9.5.0 through 9.5.4 |
| CVE-2026-94397 | 6.5 | Sep 26 | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Affected: 8.0.0 through 8.19.21; 9.0.0 through 9.4.6; 9.5.0 through 9.5.3 |
| CVE-2026-94396 | 6.5 | Sep 26 | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Affected: 9.2.0 through 9.4.6; 9.5.0 through 9.5.3 |
| CVE-2026-94399 | 6.5 | Sep 26 | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Affected: 8.0.0 through 8.19.21; 9.0.0 through 9.4.6; 9.5.0 through 9.5.3 |
| CVE-2026-94398 | 6.5 | Sep 26 | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Affected: 8.12.0 through 8.19.21; 9.0.0 through 9.4.6; 9.5.0 through 9.5.3 |
| CVE-2026-82300 | 6.5 | Sep 26 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Affected: 8.0.0 through 8.19.21; 9.0.0 through 9.4.6; 9.5.0 through 9.5.3 |
| CVE-2026-82294 | 6.5 | Sep 26 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Affected: 8.0.0 through 8.19.20; 9.0.0 through 9.4.5; 9.5.0 through 9.5.2 |
| CVE-2026-72636 | 6.5 | Aug 13 | Uncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of Service Affected: 8.0.0 through 8.19.19; 9.0.0 through 9.4.4 |
| CVE-2026-72639 | 6.5 | Aug 13 | Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service Affected: 8.19.0 through 8.19.19; 9.3.0 through 9.5.0 |
| CVE-2026-72638 | 6.5 | Aug 13 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Affected: 8.0.0 through 8.19.19; 9.0.0 through 9.4.4 |
| CVE-2026-72647 | 6.5 | Aug 13 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Affected: 8.0.0 through 8.19.19; 9.0.0 through 9.4.4 |
| CVE-2026-72645 | 6.5 | Aug 13 | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Affected: 8.0.0 through 8.19.19; 9.0.0 through 9.4.4; 9.5.0 |
| CVE-2026-72656 | 6.5 | Aug 13 | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Affected: 8.11.0 through 8.17.9 |
| CVE-2026-72679 | 6.5 | Aug 13 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Affected: 8.19.0 through 8.19.19; 9.0.0 through 9.4.4 |
| CVE-2026-72678 | 6.5 | Aug 13 | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Affected: 8.19.0 through 8.19.19; 9.4.0 through 9.4.4; 9.5.0 |
| CVE-2026-72687 | 6.5 | Aug 13 | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Affected: 8.0.0 through 8.19.19; 9.0.0 through 9.4.4; 9.5.0 |
| CVE-2026-72686 | 6.5 | Aug 13 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Affected: 8.0.0 through 8.19.19; 9.0.0 through 9.4.4; 9.5.0 |
| CVE-2026-72684 | 6.5 | Aug 13 | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service Affected: 8.0.0 through 8.19.19; 9.0.0 through 9.4.4 |
| CVE-2026-72683 | 6.5 | Aug 13 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Affected: 5.0.0 through 8.19.18; 9.3.0 through 9.3.7; 9.4.0 through 9.4.3 |
| CVE-2026-63263 | 6.5 | Jul 21 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Affected: 9.4.0 through 9.4.3; 9.0.0 through 9.3.7; 8.0.0 through 8.19.18 |
| CVE-2026-63144 | 6.5 | Jul 21 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Affected: 9.4.0 through 9.4.3; 9.3.0 through 9.3.7; 8.19.0 through 8.19.18 |
| CVE-2026-63140 | 6.5 | Jul 21 | Reachable Assertion in Elasticsearch Leading to Denial of Service Affected: 9.0.0 through 9.3.7; 9.4.0 through 9.4.3; 8.0.0 through 8.19.18 |
| CVE-2026-63136 | 6.5 | Jul 21 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Affected: 8.0.0 through 8.19.14; 9.3.0 through 9.3.3; 9.0.0 through 9.2.8 |
| CVE-2026-56145 | 6.5 | Jul 21 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Affected: 9.4.0 through 9.4.3; 8.0.0 through 8.19.17; 9.0.0 through 9.3.6 |
| CVE-2026-56144 | 6.5 | Jul 21 | Incorrect Authorization in Elasticsearch Leading to Information Disclosure Affected: 9.4.0 through 9.4.3; 9.0.0 through 9.3.7; 8.12.0 through 8.19.18 |
| CVE-2026-49090 | 6.5 | Jul 1 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service Affected: 8.0.0 through 8.14.3; 7.0.0 through 7.17.23 |
| CVE-2026-56148 | 6.5 | Jul 1 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Affected: 9.4.0 through 9.4.2; 9.0.0 through 9.3.5; 8.0.0 through 8.19.16 |
| CVE-2025-68384 | 6.5 | Dec 18 | Elasticsearch Allocation of Resources Without Limits or Throttling Affected: 7.0.0 through 7.17.29; 8.0.0 through 8.19.8; 9.0.0 through 9.1.8; 9.2.0 through 9.2.2 |
| CVE-2024-52980 | 6.5 | Apr 8 | Elasticsearch Uncontrolled Resource Consumption vulnerability Affected: 7.17.0 through 8.15.0 |
| CVE-2024-12539 | 6.5 | Dec 17 | Elasticsearch Incorrect Authorization Affected: 8.16.0 through 8.16.1 |
| CVE-2023-49921 | 6.5 | Jul 26 | An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level Affected: 7.0.0 before 7.17.16; 8.0.0 before 8.11.2 |
| CVE-2024-23445 | 6.5 | Jun 12 | It was identified that if a cross-cluster API key… Affected: 8.10.0 before 8.14.0 |
| CVE-2024-23451 | 6.5 | Mar 27 | Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elasticsearch 8.10.0 and before 8.13.0 Affected: 8.10.0 before 8.13.0 |
| CVE-2021-22147 | 6.5 | Sep 15 | Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots Affected: 7.11.0 before 7.14.0 |
| CVE-2021-22144 | 6.5 | Jul 26 | In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok… Affected: before 6.8.17; 7.0.0 before 7.13.3 |
| CVE-2021-22145 | 6.5 | Jul 21 | A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting Affected: 7.10.0 through 7.13.3 |
| CVE-2020-7019 | 6.5 | Aug 18 | In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security Affected: before 6.8.12; 7.0.0 before 7.9.0 |
| CVE-2018-17244 | 6.5 | Dec 20 | Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms Affected: 6.4.0 through 6.4.2 |
| CVE-2018-3826 | 6.5 | Sep 19 | In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API Affected: 6.0.0 through 6.2.4; 6.0.0 |
| CVE-2026-78605 | 5.9 | Sep 1 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure Affected: 8.18.0 through 8.19.19; 9.0.0 through 9.4.4; 9.5.0 |
| CVE-2019-7614 | 5.9 | Jul 30 | A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request Affected: before 6.8.2; 7.0.0 before 7.2.1 |
| CVE-2018-17247 | 5.9 | Dec 20 | Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API Affected: 6.5.0; 6.5.1 |
| CVE-2025-37727 | 5.7 | Oct 10 | Elasticsearch Insertion of sensitive information in log file Affected: 7.0.0 through 7.17.29; 8.0.0 through 8.18.7; 8.19.0 through 8.19.4; 9.0.0 through 9.0.7; 9.1.0 through 9.1.4 |
| CVE-2026-102407 | 5.4 | Oct 6 | Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification Affected: 7.17.5 through 7.17.29; 8.2.2 through 8.19.18; 9.0.0 through 9.3.7; 9.4.0 through 9.4.3 |
| CVE-2024-23449 | 5.3 | Mar 29 | An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API Affected: 8.4.0 before 8.11.1 |