Skip to content
OpenAdvisories
Medium WID-SEC-2026-4325 4 CVEs

Elasticsearch: Mehrere Schwachstellen

Published Nov 3, 2026 · Updated Nov 10, 2026 · Revision 2 · de

Vendor: Microsoft Product: Azure Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Elasticsearch ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren oder offenzulegen.

Product

Elasticsearch ist eine Open Source, verteilte Echtzeit-Suche und Analyse-Engine.

Vulnerabilities 4

  • High 7.5
    CVE-2026-115290 Public exploit

    Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

    Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted…

    Elastic Elasticsearch ruby4.0-elasticsearch ruby3.3-elasticsearch Wolfi
  • Medium 6.5
    CVE-2026-115715

    Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service

    Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an affected phonetic encoder of the analysis-phonetic plugin. An authenticated user with per…

    Elastic Elasticsearch ruby4.0-elasticsearch ruby3.3-elasticsearch Azure Linux Wolfi
  • Medium 4.3
    CVE-2026-115298

    Incorrect Authorization in Elasticsearch Leading to Information Disclosure

    Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user whose index access is restricted by field-level security can retrieve the value…

    Elastic Elasticsearch ruby4.0-elasticsearch ruby3.3-elasticsearch Azure Linux Wolfi
  • Medium 4.2
    CVE-2026-115710

    Use of Cache Containing Sensitive Information in Elasticsearch Leading to Information Disclosure

    Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search requests. For some query types, Elasticsearch can share cached query results between users wh…

    Elastic Elasticsearch ruby4.0-elasticsearch ruby3.3-elasticsearch Azure Linux Wolfi

Revision history

  1. #2

    Neue Updates aufgenommen

  2. #1

    Initiale Fassung

References