Skip to content
OpenAdvisories
High WID-SEC-2026-2841 14 CVEs

Elasticsearch: Mehrere Schwachstellen

Published Aug 13, 2026 · Updated Oct 8, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Elasticsearch ausnutzen, um beliebigen Programmcode auszuführen, und um einen Denial of Service Angriff durchzuführen.

Product

Elasticsearch ist eine Open Source, verteilte Echtzeit-Suche und Analyse-Engine.

Vulnerabilities 14

  • High 8.8
    CVE-2026-72642

    Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process

    The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of …

    Elastic Elasticsearch
  • Medium 6.5
    CVE-2026-72636

    Uncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of Service

    Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on rec…

    Elastic Elasticsearch
  • Medium 6.5
    CVE-2026-72638

    Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

    Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, m…

    Elastic Elasticsearch
  • Medium 6.5
    CVE-2026-72639

    Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service

    Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker. An authenticated user holding only read privileges on a s…

    Elastic Elasticsearch
  • Medium 6.5
    CVE-2026-72645

    Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

    Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only read privileges on a single index can submit one small, specially crafted search requ…

    Elastic Elasticsearch
  • Medium 6.5
    CVE-2026-72647

    Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

    Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose de…

    Elastic Elasticsearch
  • Medium 6.5
    CVE-2026-72656

    Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

    Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user able to submit ES|QL queries could send a specially crafted query wh…

    Elastic Elasticsearch
  • Medium 6.5
    CVE-2026-72678

    Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

    Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product…

    Elastic Elasticsearch
  • Medium 6.5
    CVE-2026-72679

    Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

    Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that exhausts the thread stack and raises a fatal error, terminating…

    Elastic Elasticsearch
  • Medium 6.5
    CVE-2026-72683

    Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

    A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ingest-simulate) to submit a request that causes a self-refer…

    Elastic Elasticsearch
  • Medium 6.5
    CVE-2026-72684

    Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service

    A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound,…

    Elastic Elasticsearch
  • Medium 6.5
    CVE-2026-72686

    Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

    A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value…

    Elastic Elasticsearch
  • Medium 6.5
    CVE-2026-72687

    Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

    A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, …

    Elastic Elasticsearch
  • Medium 4.3
    CVE-2026-72685

    Inefficient Algorithmic Complexity in Elasticsearch Leading to Denial of Service

    A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportio…

    Elastic Elasticsearch

Revision history

  1. #2

    Referenz(en) aufgenommen: ESA-2026-120, ESA-2026-133, ESA-2026-119, ESA-2026-78, ESA-2026-80, ESA-2026-77, ESA-2026-116, ESA-2026-79, ESA-2026-118

  2. #1

    Initiale Fassung

References