Bitnami package
elasticsearch
pkg:bitnami/elasticsearch
Vulnerabilities (60)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-72687 | Med | 6.5 | >= 8.0.0, < 8.19.20 | 8.19.20 | Aug 13, 2026 | A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carr | |
| CVE-2026-72686 | Med | 6.5 | >= 8.0.0, < 8.19.20 | 8.19.20 | Aug 13, 2026 | A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value being validated, so | |
| CVE-2026-72685 | Med | 4.3 | >= 8.0.0, < 8.19.20 | 8.19.20 | Aug 13, 2026 | A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, | |
| CVE-2026-72684 | Med | 6.5 | >= 8.0.0, < 9.5.0 | 9.5.0 | Aug 13, 2026 | A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation o | |
| CVE-2026-72683 | Med | 6.5 | >= 5.0.0, < 8.19.19 | 8.19.19 | Aug 13, 2026 | A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ingest-simulate) to submit a request that causes a self-referential data structure | |
| CVE-2026-72679 | Med | 6.5 | >= 8.19.0, < 8.19.20 | 8.19.20 | Aug 13, 2026 | Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that exhausts the thread stack and raises a fatal error, terminating the Elasticsearch no | |
| CVE-2026-72678 | Med | 6.5 | >= 8.19.0, < 8.19.20 | 8.19.20 | Aug 13, 2026 | Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product API endpoint that ca | |
| CVE-2026-72656 | Med | 6.5 | >= 8.11.0, < 8.17.10 | 8.17.10 | Aug 13, 2026 | Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user able to submit ES|QL queries could send a specially crafted query whose evaluation alloca | |
| CVE-2026-72647 | Med | 6.5 | >= 8.0.0, < 8.19.20 | 8.19.20 | Aug 13, 2026 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose deeply nested structure | |
| CVE-2026-72645 | Med | 6.5 | >= 8.0.0, < 8.19.20 | 8.19.20 | Aug 13, 2026 | Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only read privileges on a single index can submit one small, specially crafted search request that causes an ex | |
| CVE-2026-72642 | Hig | 8.8 | >= 8.19.0, < 8.19.20 | 8.19.20 | Aug 13, 2026 | The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storag | |
| CVE-2026-72639 | Med | 6.5 | >= 8.19.0, < 8.19.20 | 8.19.20 | Aug 13, 2026 | Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker. An authenticated user holding only read privileges on a single searchable inde | |
| CVE-2026-72638 | Med | 6.5 | >= 8.0.0, < 8.19.20 | 8.19.20 | Aug 13, 2026 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analy | |
| CVE-2026-72636 | Med | 6.5 | >= 8.0.0, < 8.19.20 | 8.19.20 | Aug 13, 2026 | Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on th | |
| CVE-2026-63263 | Med | 6.5 | >= 8.0.0, < 8.19.19 | 8.19.19 | Jul 22, 2026 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. B | |
| CVE-2026-63144 | Med | 6.5 | >= 8.0.0, < 8.19.19 | 8.19.19 | Jul 21, 2026 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within th | |
| CVE-2026-63140 | Med | 6.5 | >= 8.0.0, < 8.19.19 | 8.19.19 | Jul 21, 2026 | Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elas | |
| CVE-2026-63136 | Med | 6.5 | >= 8.0.0, < 8.19.15 | 8.19.15 | Jul 21, 2026 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node | |
| CVE-2026-56145 | Med | 6.5 | >= 8.0.0, < 8.19.18 | 8.19.18 | Jul 21, 2026 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL sequence queries against an index they control can send a specially crafted query th | |
| CVE-2026-56144 | Med | 5.3 | >= 8.12.0, < 8.19.18 | 8.19.18 | Jul 21, 2026 | Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By targeting indices they are not authorized to access directly, the user can cause th |
- affected >= 8.0.0, < 8.19.20fixed 8.19.20
A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carr
- affected >= 8.0.0, < 8.19.20fixed 8.19.20
A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value being validated, so
- affected >= 8.0.0, < 8.19.20fixed 8.19.20
A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time,
- affected >= 8.0.0, < 9.5.0fixed 9.5.0
A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation o
- affected >= 5.0.0, < 8.19.19fixed 8.19.19
A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ingest-simulate) to submit a request that causes a self-referential data structure
- affected >= 8.19.0, < 8.19.20fixed 8.19.20
Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that exhausts the thread stack and raises a fatal error, terminating the Elasticsearch no
- affected >= 8.19.0, < 8.19.20fixed 8.19.20
Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product API endpoint that ca
- affected >= 8.11.0, < 8.17.10fixed 8.17.10
Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user able to submit ES|QL queries could send a specially crafted query whose evaluation alloca
- affected >= 8.0.0, < 8.19.20fixed 8.19.20
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose deeply nested structure
- affected >= 8.0.0, < 8.19.20fixed 8.19.20
Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only read privileges on a single index can submit one small, specially crafted search request that causes an ex
- affected >= 8.19.0, < 8.19.20fixed 8.19.20
The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storag
- affected >= 8.19.0, < 8.19.20fixed 8.19.20
Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker. An authenticated user holding only read privileges on a single searchable inde
- affected >= 8.0.0, < 8.19.20fixed 8.19.20
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analy
- affected >= 8.0.0, < 8.19.20fixed 8.19.20
Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on th
- affected >= 8.0.0, < 8.19.19fixed 8.19.19
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. B
- affected >= 8.0.0, < 8.19.19fixed 8.19.19
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within th
- affected >= 8.0.0, < 8.19.19fixed 8.19.19
Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elas
- affected >= 8.0.0, < 8.19.15fixed 8.19.15
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node
- affected >= 8.0.0, < 8.19.18fixed 8.19.18
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL sequence queries against an index they control can send a specially crafted query th
- affected >= 8.12.0, < 8.19.18fixed 8.19.18
Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By targeting indices they are not authorized to access directly, the user can cause th
Page 1 of 3