Known vulnerabilities in Elasticsearch

Software: Elasticsearch
Software CPE: cpe:2.3:a:elastic_stack:elasticsearch:*:*:*:*:*:*:*:*
Total vulnerabilities: 70
Public exploits: 5
Known exploited (KEV): 2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Elasticsearch Elasticsearch is affected by 70 known vulnerabilities: 2 high, 26 medium, 42 low Critical High Medium Low

Vulnerabilities (70)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU152237 - Resource exhaustion
CVE-2026-82294
CWE-400 Low
No
No
8.19.21, 9.4.6, 9.5.3 25.09.2026 SB20260925251
#VU152236 - Resource exhaustion
CVE-2026-94408
CWE-400 Low
No
No
8.19.22, 9.4.7, 9.5.3 25.09.2026 SB20260925251
#VU152235 - Resource exhaustion
CVE-2026-82300
CWE-400 Low
No
No
8.19.22, 9.4.7, 9.5.4 25.09.2026 SB20260925251
#VU152234 - Resource exhaustion
CVE-2026-94398
CWE-400 Low
No
No
8.19.22, 9.4.7, 9.5.4 25.09.2026 SB20260925251
#VU152233 - Resource exhaustion
CVE-2026-94399
CWE-400 Low
No
No
8.19.22, 9.4.7, 9.5.4 25.09.2026 SB20260925251
#VU152232 - Resource exhaustion
CVE-2026-94397
CWE-400 Low
No
No
8.19.22, 9.4.7, 9.5.4 25.09.2026 SB20260925251
#VU152231 - Resource exhaustion
CVE-2026-94396
CWE-400 Low
No
No
9.4.7, 9.5.4 25.09.2026 SB20260925251
#VU146655 - Missing Authorization
CVE-2026-78607
CWE-862 Low
No
No
8.19.19, 9.3.8, 9.4.4, 9.5.1 01.09.2026 SB2026090169
#VU146654 - Allocation of Resources Without Limits or Throttling
CVE-2026-56143
CWE-770 Low
No
No
8.19.20, 9.3.0 01.09.2026 SB2026090169
#VU146653 - Deserialization of Untrusted Data
CVE-2026-72649
CWE-502 Medium
No
No
8.19.20, 9.4.5, 9.5.1 01.09.2026 SB2026090169
#VU146652 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2026-78605
CWE-444 Medium
No
No
8.19.20, 9.4.5, 9.5.1 01.09.2026 SB2026090169
#VU139149 - Resource exhaustion
CVE-2026-63136
CWE-400 Low
No
No
8.19.15, 9.2.9, 9.3.4 22.07.2026 SB2026072277
#VU139148 - Incorrect Authorization
CVE-2026-56144
CWE-863 Low
No
No
8.19.18, 9.3.7, 9.4.4 22.07.2026 SB2026072276
#VU139147 - Resource exhaustion
CVE-2026-56145
CWE-400 Low
No
No
8.19.18, 9.3.7, 9.4.4 22.07.2026 SB2026072276
#VU139146 - Reachable Assertion
CVE-2026-63140
CWE-617 Low
No
No
8.19.19, 9.3.8, 9.4.4 22.07.2026 SB2026072276
#VU139145 - Uncontrolled Recursion
CVE-2026-63144
CWE-674 Low
No
No
8.19.19, 9.3.8, 9.4.4 22.07.2026 SB2026072276
#VU139144 - Resource exhaustion
CVE-2026-63263
CWE-400 Low
No
No
8.19.19, 9.3.8, 9.4.4 22.07.2026 SB2026072276
#VU136671 - Allocation of Resources Without Limits or Throttling
CVE-2026-56149
CWE-770 Low
No
No
8.19.17, 9.3.6, 9.4.3 02.07.2026 SB2026070208
#VU136670 - Uncontrolled Recursion
CVE-2026-56148
CWE-674 Low
No
No
8.19.17, 9.3.6, 9.4.3 02.07.2026 SB2026070208
#VU136669 - Resource exhaustion
CVE-2026-49090
CWE-400 Medium
No
No
7.17.24, 8.15.0 02.07.2026 SB2026070207


Showing elements 1 - 20 out of 70