Elasticsearch 7.x — End of Life
EOL Medium riskElasticsearch 7.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 7 | Apr 10, 2019 | — | Jan 15, 2026 | 7.17.29 | EOL |
CVEs affecting Elasticsearch 7.x (4)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-49090 | MEDIUM | 6.5 | 0.25% | — | 7 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (C… | Jul 1, 2026 |
| CVE-2025-68390 | MEDIUM | 4.9 | 0.34% | — | 7 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with sna… | Dec 18, 2025 |
| CVE-2025-68384 | MEDIUM | 6.5 | 0.28% | — | 7 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated… | Dec 18, 2025 |
| CVE-2025-37731 | MEDIUM | 6.8 | 0.16% | — | 7 | Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certifica… | Dec 15, 2025 |
Elasticsearch 7.x is EOL — migrate to Elasticsearch 8.x
Elasticsearch 8.x is the next major release. Plan your upgrade before Elasticsearch 7.x stops receiving security patches.
Frequently asked questions
Is Elasticsearch 7 end of life?
Yes. All Elasticsearch 7.x releases have reached end of life and no longer receive security patches. There are 4 known CVEs affecting Elasticsearch 7.x. Migrate to Elasticsearch 8.x as soon as possible.
What CVEs affect Elasticsearch 7?
There are 4 CVEs tracked for Elasticsearch 7.x. See the full list above with CVSS and EPSS scores.
What is the latest Elasticsearch 7 version?
The latest Elasticsearch 7.x patch release is 7.17.29, released on June 18, 2025. Always run the latest patch to benefit from all security fixes.
How to migrate from Elasticsearch 7 to Elasticsearch 8?
To migrate from Elasticsearch 7 to Elasticsearch 8: (1) review the official Elasticsearch 8 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run Elasticsearch 7 in production?
No. Elasticsearch 7 has reached end of life and security vulnerabilities are no longer patched. Upgrade to a supported version immediately.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA