Skip to content
OpenAdvisories
Medium WID-SEC-2026-2457 6 CVEs

Elasticsearch: Mehrere Schwachstellen ermöglichen DoS und die Offenlegung von Informationen

Published Jul 21, 2026 · Updated Jul 21, 2026 · de-DE

Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Elasticsearch ausnutzen, um einen Denial of Service Angriff durchzuführen und vertrauliche Informationen offenzulegen.

Product

Elasticsearch ist eine Open Source, verteilte Echtzeit-Suche und Analyse-Engine.

Vulnerabilities 6

  • Medium 6.5
    CVE-2026-56145

    Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL sequence queries against an index they control can send a speci…

    Elastic Elasticsearch ruby4.0-elasticsearch ruby3.3-elasticsearch Wolfi
  • Medium 6.5
    CVE-2026-63136

    Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memo…

    Elastic Elasticsearch
  • Medium 6.5
    CVE-2026-63140

    Reachable Assertion in Elasticsearch Leading to Denial of Service

    Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query …

    Elastic Elasticsearch ruby4.0-elasticsearch ruby3.3-elasticsearch Wolfi
  • Medium 6.5
    CVE-2026-63144

    Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

    Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive…

    Elastic Elasticsearch ruby4.0-elasticsearch ruby3.3-elasticsearch Wolfi
  • Medium 6.5
    CVE-2026-63263

    Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

    Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption durin…

    Elastic Elasticsearch ruby4.0-elasticsearch ruby3.3-elasticsearch Wolfi
  • Medium 5.3
    CVE-2026-56144

    Incorrect Authorization in Elasticsearch Leading to Information Disclosure

    Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By targeting indices they are not authorized to access directly, …

    Elastic Elasticsearch ruby4.0-elasticsearch ruby3.3-elasticsearch Wolfi

Revision history

  1. #1

    Initiale Fassung

References