Elastic

Elasticsearch

91 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.5

CVE-2026-56144

  • EPSS 0.23%
  • Veröffentlicht 21.07.2026 20:17:02
  • Zuletzt bearbeitet 26.08.2026 12:16:21

Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By targeting indices they are not authorized to access d...

6.5

CVE-2026-49090

  • EPSS 0.25%
  • Veröffentlicht 01.07.2026 17:15:54
  • Zuletzt bearbeitet 02.07.2026 14:43:04

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk request that causes sustained high CPU consumption, which can...

4.9

CVE-2026-56149

  • EPSS 0.37%
  • Veröffentlicht 01.07.2026 16:21:24
  • Zuletzt bearbeitet 02.07.2026 17:35:59

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a specially crafted machine learning request that causes ...

6.5

CVE-2026-56148

  • EPSS 0.35%
  • Veröffentlicht 01.07.2026 16:17:05
  • Zuletzt bearbeitet 02.07.2026 17:38:29

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excessive resource consumption while the request is process...

4.9

CVE-2025-68390

  • EPSS 0.38%
  • Veröffentlicht 18.12.2025 22:17:41
  • Zuletzt bearbeitet 23.12.2025 17:44:51

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory and a denial of service (DoS) via crafted HTTP reques...

6.5

CVE-2025-68384

  • EPSS 0.32%
  • Veröffentlicht 18.12.2025 22:04:50
  • Zuletzt bearbeitet 30.09.2026 23:10:00

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized use...

7.4

CVE-2025-37731

  • EPSS 0.19%
  • Veröffentlicht 15.12.2025 10:42:21
  • Zuletzt bearbeitet 07.10.2026 19:10:00

Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.

5.7

CVE-2025-37727

  • EPSS 0.23%
  • Veröffentlicht 10.10.2025 09:56:15
  • Zuletzt bearbeitet 23.12.2025 17:39:24

Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex

7.5

CVE-2024-52979

  • EPSS 0.61%
  • Veröffentlicht 01.05.2025 13:13:07
  • Zuletzt bearbeitet 02.10.2025 16:40:31

Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.

7.5

CVE-2024-52981

  • EPSS 0.55%
  • Veröffentlicht 08.04.2025 16:54:16
  • Zuletzt bearbeitet 02.10.2025 15:33:30

An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.