SB2026072276 - Multiple vulnerabilities in Elasticsearch

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072276

SB2026072276 - Multiple vulnerabilities in Elasticsearch

Published: July 22, 2026

Security Bulletin ID SB2026072276
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Resource exhaustion (CVE-ID: CVE-2026-63263)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the ES|QL engine when processing a specially crafted query. A remote user can submit a specially crafted query to cause a denial of service.

This affects deployments where users are able to execute ES|QL queries, and repeated requests can exhaust query worker resources until the node is restarted.


2) Uncontrolled Recursion (CVE-ID: CVE-2026-63144)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the Elasticsearch query evaluation component when processing search requests. A remote user can send a specially crafted search request to cause a denial of service.

A user with read-level index access is required. In single-node deployments, exploitation can cause a complete service outage; in multi-node clusters, it can cause repeated node restarts and sustained availability degradation.


3) Reachable assertion (CVE-ID: CVE-2026-63140)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to reachable assertion in query parsing when processing a specially crafted search request containing a null value in a specific query clause. A remote user can send a specially crafted search request to cause a denial of service.

Exploitation requires read access to at least one index. In single-node deployments this stops the service, while in multi-node clusters each successful exploit reduces cluster capacity for the affected node.


4) Resource exhaustion (CVE-ID: CVE-2026-56145)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the EQL sequence query processing feature when processing a specially crafted query. A remote user can send a specially crafted query to cause a denial of service.

Exploitation requires permission to execute EQL sequence queries against an index the user controls.


5) Incorrect authorization (CVE-ID: CVE-2026-56144)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to incorrect authorization in the ingest simulation feature when simulating ingest pipelines against indices with restricted access. A remote user can target indices they are not authorized to access directly to disclose sensitive information.

This can expose ingest pipeline output and index mapping metadata for indices with restricted access when deployments have configured ingest pipelines and users with differing levels of index privileges.


Remediation

Install update from vendor's website.

References