Known vulnerabilities in Elasticsearch
Vendor:
Elastic Stack
Software:
Elasticsearch
Software CPE:
cpe:2.3:a:elastic_stack:elasticsearch:*:*:*:*:*:*:*:*
Website:
https://www.elastic.co/
Total vulnerabilities:
53
Public exploits:
5
Known exploited (KEV):
1
Highest CVSSv4 Score:
8.8
Breakdown by Severity Chart
9.5.2
9.5.1
9.4.5
8.19.20
9.5.0
9.2.9
9.4.4
9.3.8
8.19.19
8.19.18
9.3.7
9.4.3
8.19.17
9.3.6
9.4.2
9.3.5
8.19.16
9.4.1
9.4.0
8.19.15
9.3.4
9.2.8
8.19.14
9.3.3
9.3.2
9.2.7
8.19.13
9.3.1
9.2.6
8.19.12
9.3.0
9.2.5
8.19.11
9.1.10
8.19.10
9.2.4
9.2.3
9.1.9
8.19.9
9.2.2
9.1.8
8.19.8
9.1.7
8.19.7
9.2.1
9.1.6
9.2.0
8.19.6
9.1.5
9.0.8
8.19.5
8.18.8
9.1.4
8.19.4
9.0.7
8.18.7
8.19.3
8.18.6
9.1.3
9.0.6
9.1.2
8.19.2
9.0.5
8.18.5
8.17.10
8.19.1
9.1.1
9.1.0
8.19.0
9.0.4
8.18.4
8.17.9
9.0.3
8.18.3
7.17.29
8.17.8
9.0.2
8.17.7
8.18.2
9.0.1
8.18.1
8.17.6
8.17.5
8.18.0
9.0.0
8.17.4
8.16.6
8.16.5
8.17.3
7.17.28
8.16.4
8.17.2
8.17.1
8.16.3
7.17.27
8.16.2
8.17.0
7.17.26
8.15.5
8.16.1
8.16.0
8.15.4
7.17.25
8.15.3
8.15.2
7.17.24
8.15.1
8.15.0
7.17.23
8.14.3
8.14.2
7.17.22
8.14.1
8.14.0
8.13.4
8.13.3
7.17.21
7.17.20
8.13.2
8.13.1
8.13.0
7.17.19
8.12.2
8.12.1
7.17.18
7.17.17
8.12.0
8.11.4
8.11.3
7.17.16
8.11.2
7.17.15
8.11.1
8.11.0
8.10.4
8.10.3
7.17.14
8.10.2
8.10.1
8.10.0
8.9.2
7.17.13
8.9.1
8.9.0
7.17.12
8.8.2
7.17.11
8.8.1
8.8.0
7.17.10
8.7.1
8.7.0
8.6.2
7.17.9
8.6.1
8.6.0
8.5.3
7.17.8
8.5.2
8.5.1
8.5.0
7.17.7
8.4.3
8.4.2
8.4.1
8.4.0
7.17.6
8.3.3
8.3.2
8.3.1
8.3.0
7.17.5
8.2.3
8.2.2
8.2.1
7.17.4
8.2.0
8.1.3
7.17.3
8.1.2
7.17.2
8.1.1
8.1.0
8.0.1
7.17.1
8.0.0
7.17.0
7.16.3
6.8.23
7.16.2
6.8.22
7.16.1
6.8.21
7.16.0
7.15.2
7.15.1
6.8.20
7.15.0
7.14.2
6.8.19
7.14.1
6.8.18
7.14.0
7.13.4
6.8.17
7.13.3
7.13.2
7.13.1
6.8.16
7.13.0
7.12.1
7.12.0
6.8.15
7.11.2
7.11.1
6.8.14
7.11.0
7.10.2
7.10.1
7.10.0
6.8.13
7.9.3
7.9.2
7.9.1
6.8.12
7.9.0
6.8.11
7.8.1
7.8.0
6.8.10
7.7.1
6.8.9
7.7.0
7.6.2
6.8.8
6.8.7
7.6.1
7.6.0
7.5.2
7.5.1
6.8.6
7.5.0
6.8.5
7.4.2
7.4.1
6.8.4
7.4.0
7.3.2
6.8.3
7.3.1
6.8.2
7.2.1
7.3.0
7.2.0
6.7.2
6.8.0
6.8.1
7.0.1
7.1.0
7.1.1
0.4.0
0.5.0
0.5.1
0.6.0
0.7.0
0.7.1
0.8.0
0.9.0
0.10.0
0.11.0
0.12.0
0.12.1
0.13.0
0.13.1
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.15.0
0.15.1
0.15.2
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.17.7
0.17.8
0.17.9
0.17.10
0.18.0
0.18.1
0.18.2
0.18.3
0.18.4
0.18.5
0.18.6
0.18.7
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.19.6
0.19.7
0.19.8
0.19.9
0.19.10
0.19.11
0.19.12
0.20.0
0.20.1
0.20.2
0.20.3
0.20.4
0.20.5
0.20.6
0.90.0
0.90.1
0.90.2
0.90.3
0.90.4
0.90.5
0.90.6
0.90.7
0.90.8
0.90.9
0.90.10
0.90.11
0.90.12
0.90.13
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.3.8
1.3.9
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.5.0
1.5.1
1.5.2
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.7.6
2.0.0
2.0.1
2.0.2
2.1.0
7.0.0-beta1
6.7.1
7.0.0-rc2
7.0.0-rc1
6.5.3
6.4.3
6.4.2
6.4.1
6.4.0
6.3.2
6.3.1
6.3.0
6.2.4
6.2.3
6.2.2
6.2.1
6.2.0
6.1.4
6.1.3
6.1.2
6.1.1
6.1.0
6.0.1
6.0.0
5.6.14
5.6.13
5.6.12
5.6.11
5.6.10
5.6.9
5.6.8
5.6.7
5.6.6
5.6.5
5.6.4
5.6.3
5.6.2
5.6.1
5.6.0
5.5.3
5.5.2
5.5.1
5.5.0
5.4.3
5.4.2
5.4.1
5.4.0
5.3.3
5.3.2
5.3.1
5.3.0
5.2.2
5.2.1
5.2.0
5.1.2
5.1.1
5.0.2
5.0.1
5.0.0
2.4.6
2.4.5
2.4.4
2.4.3
2.4.2
2.4.1
2.4.0
2.3.5
2.3.4
2.3.3
2.3.2
2.3.1
2.3.0
2.2.2
2.2.1
2.2.0
2.1.2
2.1.1
7.0.0
6.7.0
6.6.2
6.6.1
6.6.0
6.5.4
5.6.16
5.6.15
6.5.2
6.5.1
6.5.0
Vulnerabilities (53)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU146655 - Missing Authorization CVE-2026-78607 |
CWE-862 | Low | 8.19.19, 9.3.8, 9.4.4, 9.5.1 | 01.09.2026 |
SB2026090169 |
||
| #VU146654 - Allocation of Resources Without Limits or Throttling CVE-2026-56143 |
CWE-770 | Low | 8.19.20, 9.3.0 | 01.09.2026 |
SB2026090169 |
||
| #VU146653 - Deserialization of Untrusted Data CVE-2026-72649 |
CWE-502 | Medium | 8.19.20, 9.4.5, 9.5.1 | 01.09.2026 |
SB2026090169 |
||
| #VU146652 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') CVE-2026-78605 |
CWE-444 | Medium | 8.19.20, 9.4.5, 9.5.1 | 01.09.2026 |
SB2026090169 |
||
| #VU139149 - Resource exhaustion CVE-2026-63136 |
CWE-400 | Low | 8.19.15, 9.2.9, 9.3.4 | 22.07.2026 |
SB2026072277 |
||
| #VU139148 - Incorrect Authorization CVE-2026-56144 |
CWE-863 | Low | 8.19.18, 9.3.7, 9.4.4 | 22.07.2026 |
SB2026072276 |
||
| #VU139147 - Resource exhaustion CVE-2026-56145 |
CWE-400 | Low | 8.19.18, 9.3.7, 9.4.4 | 22.07.2026 |
SB2026072276 |
||
| #VU139146 - Reachable Assertion CVE-2026-63140 |
CWE-617 | Low | 8.19.19, 9.3.8, 9.4.4 | 22.07.2026 |
SB2026072276 |
||
| #VU139145 - Uncontrolled Recursion CVE-2026-63144 |
CWE-674 | Low | 8.19.19, 9.3.8, 9.4.4 | 22.07.2026 |
SB2026072276 |
||
| #VU139144 - Resource exhaustion CVE-2026-63263 |
CWE-400 | Low | 8.19.19, 9.3.8, 9.4.4 | 22.07.2026 |
SB2026072276 |
||
| #VU136671 - Allocation of Resources Without Limits or Throttling CVE-2026-56149 |
CWE-770 | Low | 8.19.17, 9.3.6, 9.4.3 | 02.07.2026 |
SB2026070208 |
||
| #VU136670 - Uncontrolled Recursion CVE-2026-56148 |
CWE-674 | Low | 8.19.17, 9.3.6, 9.4.3 | 02.07.2026 |
SB2026070208 |
||
| #VU136669 - Resource exhaustion CVE-2026-49090 |
CWE-400 | Medium | 7.17.24, 8.15.0 | 02.07.2026 |
SB2026070207 |
||
| #VU121007 - Exposure of sensitive information to an unauthorized actor CVE-2025-66566 |
CWE-200 | Medium | 8.19.10, 9.1.10, 9.2.4 | 07.01.2026 |
SB2026010702 SB2026010705 SB2026010706 and 28 more |
||
| #VU120208 - Resource exhaustion CVE-2025-68384 |
CWE-400 | Medium | 8.19.9, 9.1.9, 9.2.3 | 19.12.2025 |
SB2025121916 |
||
| #VU120207 - Resource exhaustion CVE-2025-68390 |
CWE-400 | Low | 8.19.8, 9.1.8, 9.2.2 | 19.12.2025 |
SB2025121524 SB2026041730 SB2026062332 |
||
| #VU119962 - Improper Authentication CVE-2025-37731 |
CWE-287 | Medium | 8.19.8, 9.1.8, 9.2.2 | 15.12.2025 |
SB2025121524 SB2026041730 |
||
| #VU116631 - Information Exposure Through Log Files CVE-2025-37727 |
CWE-532 | Medium | 8.18.8, 8.19.5, 9.0.8, 9.1.5 | 06.10.2025 |
SB2025100653 SB2026031331 SB2026041730 |
||
| #VU114385 - Improper Restriction of XML External Entity Reference ('XXE') CVE-2025-54988 |
CWE-611 | Medium | 8.18.6, 8.19.3, 9.0.6, 9.1.3 | 22.08.2025 |
SB2025082219 SB2025083007 SB2025083008 and 31 more |
||
| #VU109603 - Deserialization of Untrusted Data CVE-2025-32434 |
CWE-502 | High | 8.19.8, 9.1.8 | 21.05.2025 |
SB20250521126 SB2025061310 SB2026011967 and 3 more |
Showing elements 1 - 20 out of 53