Elasticsearch 9.x — End of Life
Active High risk6 releases in this series43 CVEs
Elasticsearch 9.x is partially supported: only 9.5, 9.4 still receive security fixes. The most recent release in this series is 9.5.5. 43 CVEs are tracked for this series. 39 of them were published after the end of life of the affected cycle and will not get an official patch.
Elasticsearch 9.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 9.5 | Aug 4, 2026 | — | No | 9.5.5 | Active | |
| 9.4 | May 5, 2026 | — | No | 9.4.8 | Active | |
| 9.3 | Feb 3, 2026 | — | Aug 4, 2026 | 9.3.8 | EOL | |
| 9.2 | Oct 23, 2025 | — | May 5, 2026 | 9.2.8 | EOL | |
| 9.1 | Jul 29, 2025 | — | Feb 3, 2026 | 9.1.10 | EOL | |
| 9.0 | Apr 15, 2025 | — | Oct 23, 2025 | 9.0.8 | EOL |
CVEs affecting Elasticsearch 9.x (204)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-103009 | HIGH | 7.1 | 0.23% | — | 9.2 | Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a spe… | Oct 6, 2026 |
| CVE-2026-103009 | HIGH | 7.1 | 0.23% | — | 9.4 | Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a spe… | Oct 6, 2026 |
| CVE-2026-103009 | HIGH | 7.1 | 0.23% | — | 9.1 | Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a spe… | Oct 6, 2026 |
| CVE-2026-103009 | HIGH | 7.1 | 0.23% | — | 9.3 | Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a spe… | Oct 6, 2026 |
| CVE-2026-103009 | HIGH | 7.1 | 0.23% | — | 9.0 | Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a spe… | Oct 6, 2026 |
| CVE-2026-103009 | HIGH | 7.1 | 0.23% | — | 9.5 | Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a spe… | Oct 6, 2026 |
| CVE-2026-103008 | MEDIUM | 6.5 | 0.30% | — | 9.5 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that cau… | Oct 6, 2026 |
| CVE-2026-103008 | MEDIUM | 6.5 | 0.30% | — | 9.4 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that cau… | Oct 6, 2026 |
| CVE-2026-103008 | MEDIUM | 6.5 | 0.30% | — | 9.2 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that cau… | Oct 6, 2026 |
| CVE-2026-103008 | MEDIUM | 6.5 | 0.30% | — | 9.3 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that cau… | Oct 6, 2026 |
| CVE-2026-103008 | MEDIUM | 6.5 | 0.30% | — | 9.0 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that cau… | Oct 6, 2026 |
| CVE-2026-103008 | MEDIUM | 6.5 | 0.30% | — | 9.1 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that cau… | Oct 6, 2026 |
| CVE-2026-103007 | HIGH | 7.2 | 0.34% | — | 9.3 | Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privi… | Oct 6, 2026 |
| CVE-2026-103007 | HIGH | 7.2 | 0.34% | — | 9.1 | Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privi… | Oct 6, 2026 |
| CVE-2026-103007 | HIGH | 7.2 | 0.34% | — | 9.4 | Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privi… | Oct 6, 2026 |
| CVE-2026-103007 | HIGH | 7.2 | 0.34% | — | 9.0 | Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privi… | Oct 6, 2026 |
| CVE-2026-103007 | HIGH | 7.2 | 0.34% | — | 9.5 | Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privi… | Oct 6, 2026 |
| CVE-2026-103007 | HIGH | 7.2 | 0.34% | — | 9.2 | Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privi… | Oct 6, 2026 |
| CVE-2026-103006 | MEDIUM | 6.5 | 0.41% | — | 9.5 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested r… | Oct 6, 2026 |
| CVE-2026-103006 | MEDIUM | 6.5 | 0.41% | — | 9.0 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested r… | Oct 6, 2026 |
| CVE-2026-103006 | MEDIUM | 6.5 | 0.41% | — | 9.2 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested r… | Oct 6, 2026 |
| CVE-2026-103006 | MEDIUM | 6.5 | 0.41% | — | 9.1 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested r… | Oct 6, 2026 |
| CVE-2026-103006 | MEDIUM | 6.5 | 0.41% | — | 9.4 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested r… | Oct 6, 2026 |
| CVE-2026-103006 | MEDIUM | 6.5 | 0.41% | — | 9.3 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested r… | Oct 6, 2026 |
| CVE-2026-103005 | MEDIUM | 6.5 | 0.30% | — | 9.1 | Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Alloc… | Oct 6, 2026 |
| CVE-2026-103005 | MEDIUM | 6.5 | 0.30% | — | 9.5 | Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Alloc… | Oct 6, 2026 |
| CVE-2026-103005 | MEDIUM | 6.5 | 0.30% | — | 9.2 | Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Alloc… | Oct 6, 2026 |
| CVE-2026-103005 | MEDIUM | 6.5 | 0.30% | — | 9.3 | Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Alloc… | Oct 6, 2026 |
| CVE-2026-103005 | MEDIUM | 6.5 | 0.30% | — | 9.4 | Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Alloc… | Oct 6, 2026 |
| CVE-2026-103005 | MEDIUM | 6.5 | 0.30% | — | 9.0 | Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Alloc… | Oct 6, 2026 |
| CVE-2026-102411 | MEDIUM | 6.5 | 0.30% | — | 9.5 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excess… | Oct 6, 2026 |
| CVE-2026-102411 | MEDIUM | 6.5 | 0.30% | — | 9.3 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excess… | Oct 6, 2026 |
| CVE-2026-102411 | MEDIUM | 6.5 | 0.30% | — | 9.2 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excess… | Oct 6, 2026 |
| CVE-2026-102411 | MEDIUM | 6.5 | 0.30% | — | 9.0 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excess… | Oct 6, 2026 |
| CVE-2026-102411 | MEDIUM | 6.5 | 0.30% | — | 9.1 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excess… | Oct 6, 2026 |
| CVE-2026-102411 | MEDIUM | 6.5 | 0.30% | — | 9.4 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excess… | Oct 6, 2026 |
| CVE-2026-102409 | MEDIUM | 6.5 | 0.30% | — | 9.5 | Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an El… | Oct 6, 2026 |
| CVE-2026-102409 | MEDIUM | 6.5 | 0.30% | — | 9.2 | Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an El… | Oct 6, 2026 |
| CVE-2026-102409 | MEDIUM | 6.5 | 0.30% | — | 9.3 | Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an El… | Oct 6, 2026 |
| CVE-2026-102409 | MEDIUM | 6.5 | 0.30% | — | 9.4 | Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an El… | Oct 6, 2026 |
| CVE-2026-102408 | MEDIUM | 4.3 | 0.34% | — | 9.4 | Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expressi… | Oct 6, 2026 |
| CVE-2026-102408 | MEDIUM | 4.3 | 0.34% | — | 9.1 | Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expressi… | Oct 6, 2026 |
| CVE-2026-102408 | MEDIUM | 4.3 | 0.34% | — | 9.2 | Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expressi… | Oct 6, 2026 |
| CVE-2026-102408 | MEDIUM | 4.3 | 0.34% | — | 9.3 | Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expressi… | Oct 6, 2026 |
| CVE-2026-102408 | MEDIUM | 4.3 | 0.34% | — | 9.5 | Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expressi… | Oct 6, 2026 |
| CVE-2026-102407 | MEDIUM | 5.4 | 0.21% | — | 9.1 | Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Funct… | Oct 6, 2026 |
| CVE-2026-102407 | MEDIUM | 5.4 | 0.21% | — | 9.0 | Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Funct… | Oct 6, 2026 |
| CVE-2026-102407 | MEDIUM | 5.4 | 0.21% | — | 9.4 | Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Funct… | Oct 6, 2026 |
| CVE-2026-102407 | MEDIUM | 5.4 | 0.21% | — | 9.3 | Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Funct… | Oct 6, 2026 |
| CVE-2026-102407 | MEDIUM | 5.4 | 0.21% | — | 9.2 | Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Funct… | Oct 6, 2026 |
| CVE-2026-102404 | MEDIUM | 6.5 | 0.30% | — | 9.2 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Oct 6, 2026 |
| CVE-2026-102404 | MEDIUM | 6.5 | 0.30% | — | 9.3 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Oct 6, 2026 |
| CVE-2026-102404 | MEDIUM | 6.5 | 0.30% | — | 9.1 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Oct 6, 2026 |
| CVE-2026-102404 | MEDIUM | 6.5 | 0.30% | — | 9.0 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Oct 6, 2026 |
| CVE-2026-102404 | MEDIUM | 6.5 | 0.30% | — | 9.4 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Oct 6, 2026 |
| CVE-2026-102404 | MEDIUM | 6.5 | 0.30% | — | 9.5 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Oct 6, 2026 |
| CVE-2026-94408 | MEDIUM | 4.9 | 0.44% | — | 9.2 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94408 | MEDIUM | 4.9 | 0.44% | — | 9.4 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94408 | MEDIUM | 4.9 | 0.44% | — | 9.5 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94408 | MEDIUM | 4.9 | 0.44% | — | 9.1 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94408 | MEDIUM | 4.9 | 0.44% | — | 9.0 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94408 | MEDIUM | 4.9 | 0.44% | — | 9.3 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94399 | MEDIUM | 6.5 | 0.42% | — | 9.5 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94399 | MEDIUM | 6.5 | 0.42% | — | 9.3 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94399 | MEDIUM | 6.5 | 0.42% | — | 9.4 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94399 | MEDIUM | 6.5 | 0.42% | — | 9.2 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94399 | MEDIUM | 6.5 | 0.42% | — | 9.0 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94399 | MEDIUM | 6.5 | 0.42% | — | 9.1 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94398 | MEDIUM | 6.5 | 0.42% | — | 9.0 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94398 | MEDIUM | 6.5 | 0.42% | — | 9.1 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94398 | MEDIUM | 6.5 | 0.42% | — | 9.2 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94398 | MEDIUM | 6.5 | 0.42% | — | 9.3 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94398 | MEDIUM | 6.5 | 0.42% | — | 9.5 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94398 | MEDIUM | 6.5 | 0.42% | — | 9.4 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94397 | MEDIUM | 6.5 | 0.42% | — | 9.3 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94397 | MEDIUM | 6.5 | 0.42% | — | 9.0 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94397 | MEDIUM | 6.5 | 0.42% | — | 9.5 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94397 | MEDIUM | 6.5 | 0.42% | — | 9.4 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94397 | MEDIUM | 6.5 | 0.42% | — | 9.1 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94397 | MEDIUM | 6.5 | 0.42% | — | 9.2 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94396 | MEDIUM | 6.5 | 0.42% | — | 9.4 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94396 | MEDIUM | 6.5 | 0.42% | — | 9.3 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94396 | MEDIUM | 6.5 | 0.42% | — | 9.5 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-94396 | MEDIUM | 6.5 | 0.42% | — | 9.2 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-… | Sep 26, 2026 |
| CVE-2026-82300 | MEDIUM | 6.5 | 0.42% | — | 9.4 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Sep 26, 2026 |
| CVE-2026-82300 | MEDIUM | 6.5 | 0.42% | — | 9.3 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Sep 26, 2026 |
| CVE-2026-82300 | MEDIUM | 6.5 | 0.42% | — | 9.0 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Sep 26, 2026 |
| CVE-2026-82300 | MEDIUM | 6.5 | 0.42% | — | 9.5 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Sep 26, 2026 |
| CVE-2026-82300 | MEDIUM | 6.5 | 0.42% | — | 9.1 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Sep 26, 2026 |
| CVE-2026-82300 | MEDIUM | 6.5 | 0.42% | — | 9.2 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Sep 26, 2026 |
| CVE-2026-82294 | MEDIUM | 6.5 | 0.42% | — | 9.1 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Sep 26, 2026 |
| CVE-2026-82294 | MEDIUM | 6.5 | 0.42% | — | 9.4 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Sep 26, 2026 |
| CVE-2026-82294 | MEDIUM | 6.5 | 0.42% | — | 9.2 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Sep 26, 2026 |
| CVE-2026-82294 | MEDIUM | 6.5 | 0.42% | — | 9.3 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Sep 26, 2026 |
| CVE-2026-82294 | MEDIUM | 6.5 | 0.42% | — | 9.0 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Sep 26, 2026 |
| CVE-2026-82294 | MEDIUM | 6.5 | 0.42% | — | 9.5 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Sep 26, 2026 |
| CVE-2026-56143 | MEDIUM | 4.9 | 0.44% | — | 9.1 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Exce… | Sep 1, 2026 |
| CVE-2026-56143 | MEDIUM | 4.9 | 0.44% | — | 9.0 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Exce… | Sep 1, 2026 |
| CVE-2026-56143 | MEDIUM | 4.9 | 0.44% | — | 9.3 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Exce… | Sep 1, 2026 |
| CVE-2026-56143 | MEDIUM | 4.9 | 0.44% | — | 9.2 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Exce… | Sep 1, 2026 |
| CVE-2026-72687 | MEDIUM | 6.5 | 0.42% | — | 9.4 | A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged … | Aug 13, 2026 |
| CVE-2026-72687 | MEDIUM | 6.5 | 0.42% | — | 9.3 | A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged … | Aug 13, 2026 |
| CVE-2026-72687 | MEDIUM | 6.5 | 0.42% | — | 9.2 | A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged … | Aug 13, 2026 |
| CVE-2026-72687 | MEDIUM | 6.5 | 0.42% | — | 9.0 | A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged … | Aug 13, 2026 |
| CVE-2026-72687 | MEDIUM | 6.5 | 0.42% | — | 9.1 | A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged … | Aug 13, 2026 |
| CVE-2026-72687 | MEDIUM | 6.5 | 0.42% | — | 9.5 | A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged … | Aug 13, 2026 |
| CVE-2026-72686 | MEDIUM | 6.5 | 0.56% | — | 9.0 | A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-… | Aug 13, 2026 |
| CVE-2026-72686 | MEDIUM | 6.5 | 0.56% | — | 9.4 | A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-… | Aug 13, 2026 |
| CVE-2026-72686 | MEDIUM | 6.5 | 0.56% | — | 9.3 | A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-… | Aug 13, 2026 |
| CVE-2026-72686 | MEDIUM | 6.5 | 0.56% | — | 9.5 | A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-… | Aug 13, 2026 |
| CVE-2026-72686 | MEDIUM | 6.5 | 0.56% | — | 9.1 | A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-… | Aug 13, 2026 |
| CVE-2026-72686 | MEDIUM | 6.5 | 0.56% | — | 9.2 | A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-… | Aug 13, 2026 |
| CVE-2026-72685 | MEDIUM | 4.3 | 0.36% | — | 9.1 | A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small docu… | Aug 13, 2026 |
| CVE-2026-72685 | MEDIUM | 4.3 | 0.36% | — | 9.2 | A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small docu… | Aug 13, 2026 |
| CVE-2026-72685 | MEDIUM | 4.3 | 0.36% | — | 9.4 | A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small docu… | Aug 13, 2026 |
| CVE-2026-72685 | MEDIUM | 4.3 | 0.36% | — | 9.0 | A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small docu… | Aug 13, 2026 |
| CVE-2026-72685 | MEDIUM | 4.3 | 0.36% | — | 9.3 | A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small docu… | Aug 13, 2026 |
| CVE-2026-72684 | MEDIUM | 6.5 | 0.42% | — | 9.2 | A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request conta… | Aug 13, 2026 |
| CVE-2026-72684 | MEDIUM | 6.5 | 0.42% | — | 9.4 | A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request conta… | Aug 13, 2026 |
| CVE-2026-72684 | MEDIUM | 6.5 | 0.42% | — | 9.0 | A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request conta… | Aug 13, 2026 |
| CVE-2026-72684 | MEDIUM | 6.5 | 0.42% | — | 9.3 | A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request conta… | Aug 13, 2026 |
| CVE-2026-72684 | MEDIUM | 6.5 | 0.42% | — | 9.1 | A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request conta… | Aug 13, 2026 |
| CVE-2026-72683 | MEDIUM | 6.5 | 0.56% | — | 9.4 | A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API en… | Aug 13, 2026 |
| CVE-2026-72683 | MEDIUM | 6.5 | 0.56% | — | 9.3 | A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API en… | Aug 13, 2026 |
| CVE-2026-72679 | MEDIUM | 6.5 | 0.47% | — | 9.0 | Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an interva… | Aug 13, 2026 |
| CVE-2026-72679 | MEDIUM | 6.5 | 0.47% | — | 9.4 | Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an interva… | Aug 13, 2026 |
| CVE-2026-72679 | MEDIUM | 6.5 | 0.47% | — | 9.2 | Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an interva… | Aug 13, 2026 |
| CVE-2026-72679 | MEDIUM | 6.5 | 0.47% | — | 9.1 | Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an interva… | Aug 13, 2026 |
| CVE-2026-72679 | MEDIUM | 6.5 | 0.47% | — | 9.3 | Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an interva… | Aug 13, 2026 |
| CVE-2026-72678 | MEDIUM | 6.5 | 0.47% | — | 9.4 | Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memor… | Aug 13, 2026 |
| CVE-2026-72678 | MEDIUM | 6.5 | 0.47% | — | 9.5 | Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memor… | Aug 13, 2026 |
| CVE-2026-72647 | MEDIUM | 6.5 | 0.42% | — | 9.0 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads… | Aug 13, 2026 |
| CVE-2026-72647 | MEDIUM | 6.5 | 0.42% | — | 9.3 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads… | Aug 13, 2026 |
| CVE-2026-72647 | MEDIUM | 6.5 | 0.42% | — | 9.1 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads… | Aug 13, 2026 |
| CVE-2026-72647 | MEDIUM | 6.5 | 0.42% | — | 9.2 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads… | Aug 13, 2026 |
| CVE-2026-72647 | MEDIUM | 6.5 | 0.42% | — | 9.4 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads… | Aug 13, 2026 |
| CVE-2026-72645 | MEDIUM | 6.5 | 0.42% | — | 9.0 | Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Alloc… | Aug 13, 2026 |
| CVE-2026-72645 | MEDIUM | 6.5 | 0.42% | — | 9.4 | Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Alloc… | Aug 13, 2026 |
| CVE-2026-72645 | MEDIUM | 6.5 | 0.42% | — | 9.3 | Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Alloc… | Aug 13, 2026 |
| CVE-2026-72645 | MEDIUM | 6.5 | 0.42% | — | 9.1 | Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Alloc… | Aug 13, 2026 |
| CVE-2026-72645 | MEDIUM | 6.5 | 0.42% | — | 9.5 | Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Alloc… | Aug 13, 2026 |
| CVE-2026-72645 | MEDIUM | 6.5 | 0.42% | — | 9.2 | Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Alloc… | Aug 13, 2026 |
| CVE-2026-72642 | HIGH | 8.8 | 0.60% | — | 9.4 | The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operat… | Aug 13, 2026 |
| CVE-2026-72642 | HIGH | 8.8 | 0.60% | — | 9.5 | The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operat… | Aug 13, 2026 |
| CVE-2026-72639 | MEDIUM | 6.5 | 0.42% | — | 9.4 | Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the… | Aug 13, 2026 |
| CVE-2026-72639 | MEDIUM | 6.5 | 0.42% | — | 9.3 | Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the… | Aug 13, 2026 |
| CVE-2026-72639 | MEDIUM | 6.5 | 0.42% | — | 9.5 | Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the… | Aug 13, 2026 |
| CVE-2026-72638 | MEDIUM | 6.5 | 0.42% | — | 9.4 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153).… | Aug 13, 2026 |
| CVE-2026-72638 | MEDIUM | 6.5 | 0.42% | — | 9.1 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153).… | Aug 13, 2026 |
| CVE-2026-72638 | MEDIUM | 6.5 | 0.42% | — | 9.3 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153).… | Aug 13, 2026 |
| CVE-2026-72638 | MEDIUM | 6.5 | 0.42% | — | 9.0 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153).… | Aug 13, 2026 |
| CVE-2026-72638 | MEDIUM | 6.5 | 0.42% | — | 9.2 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153).… | Aug 13, 2026 |
| CVE-2026-72636 | MEDIUM | 6.5 | 0.41% | — | 9.1 | Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Exces… | Aug 13, 2026 |
| CVE-2026-72636 | MEDIUM | 6.5 | 0.41% | — | 9.2 | Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Exces… | Aug 13, 2026 |
| CVE-2026-72636 | MEDIUM | 6.5 | 0.41% | — | 9.4 | Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Exces… | Aug 13, 2026 |
| CVE-2026-72636 | MEDIUM | 6.5 | 0.41% | — | 9.0 | Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Exces… | Aug 13, 2026 |
| CVE-2026-72636 | MEDIUM | 6.5 | 0.41% | — | 9.3 | Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Exces… | Aug 13, 2026 |
| CVE-2026-63263 | MEDIUM | 6.5 | 0.47% | — | 9.4 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansio… | Jul 22, 2026 |
| CVE-2026-63263 | MEDIUM | 6.5 | 0.47% | — | 9.3 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansio… | Jul 22, 2026 |
| CVE-2026-63263 | MEDIUM | 6.5 | 0.47% | — | 9.0 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansio… | Jul 22, 2026 |
| CVE-2026-63263 | MEDIUM | 6.5 | 0.47% | — | 9.1 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansio… | Jul 22, 2026 |
| CVE-2026-63263 | MEDIUM | 6.5 | 0.47% | — | 9.2 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansio… | Jul 22, 2026 |
| CVE-2026-63144 | MEDIUM | 6.5 | 0.42% | — | 9.3 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request s… | Jul 21, 2026 |
| CVE-2026-63144 | MEDIUM | 6.5 | 0.42% | — | 9.4 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request s… | Jul 21, 2026 |
| CVE-2026-63140 | MEDIUM | 6.5 | 0.42% | — | 9.0 | Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A … | Jul 21, 2026 |
| CVE-2026-63140 | MEDIUM | 6.5 | 0.42% | — | 9.1 | Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A … | Jul 21, 2026 |
| CVE-2026-63140 | MEDIUM | 6.5 | 0.42% | — | 9.4 | Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A … | Jul 21, 2026 |
| CVE-2026-63140 | MEDIUM | 6.5 | 0.42% | — | 9.2 | Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A … | Jul 21, 2026 |
| CVE-2026-63140 | MEDIUM | 6.5 | 0.42% | — | 9.3 | Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A … | Jul 21, 2026 |
| CVE-2026-63136 | MEDIUM | 6.5 | 0.42% | — | 9.3 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Jul 21, 2026 |
| CVE-2026-63136 | MEDIUM | 6.5 | 0.42% | — | 9.2 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Jul 21, 2026 |
| CVE-2026-63136 | MEDIUM | 6.5 | 0.42% | — | 9.1 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Jul 21, 2026 |
| CVE-2026-63136 | MEDIUM | 6.5 | 0.42% | — | 9.0 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Jul 21, 2026 |
| CVE-2026-56145 | MEDIUM | 6.5 | 0.47% | — | 9.4 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Jul 21, 2026 |
| CVE-2026-56145 | MEDIUM | 6.5 | 0.47% | — | 9.0 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Jul 21, 2026 |
| CVE-2026-56145 | MEDIUM | 6.5 | 0.47% | — | 9.2 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Jul 21, 2026 |
| CVE-2026-56145 | MEDIUM | 6.5 | 0.47% | — | 9.1 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Jul 21, 2026 |
| CVE-2026-56145 | MEDIUM | 6.5 | 0.47% | — | 9.3 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP… | Jul 21, 2026 |
| CVE-2026-56144 | MEDIUM | 5.3 | 0.32% | — | 9.0 | Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to expl… | Jul 21, 2026 |
| CVE-2026-56144 | MEDIUM | 5.3 | 0.32% | — | 9.3 | Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to expl… | Jul 21, 2026 |
| CVE-2026-56144 | MEDIUM | 5.3 | 0.32% | — | 9.1 | Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to expl… | Jul 21, 2026 |
| CVE-2026-56144 | MEDIUM | 5.3 | 0.32% | — | 9.2 | Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to expl… | Jul 21, 2026 |
| CVE-2026-56144 | MEDIUM | 5.3 | 0.32% | — | 9.4 | Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to expl… | Jul 21, 2026 |
| CVE-2026-56149 | MEDIUM | 4.9 | 0.50% | — | 9.0 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Exce… | Jul 1, 2026 |
| CVE-2026-56149 | MEDIUM | 4.9 | 0.50% | — | 9.1 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Exce… | Jul 1, 2026 |
| CVE-2026-56149 | MEDIUM | 4.9 | 0.50% | — | 9.4 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Exce… | Jul 1, 2026 |
| CVE-2026-56149 | MEDIUM | 4.9 | 0.50% | — | 9.3 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Exce… | Jul 1, 2026 |
| CVE-2026-56149 | MEDIUM | 4.9 | 0.50% | — | 9.2 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Exce… | Jul 1, 2026 |
| CVE-2026-56148 | MEDIUM | 6.5 | 0.47% | — | 9.3 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). … | Jul 1, 2026 |
| CVE-2026-56148 | MEDIUM | 6.5 | 0.47% | — | 9.4 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). … | Jul 1, 2026 |
| CVE-2026-56148 | MEDIUM | 6.5 | 0.47% | — | 9.0 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). … | Jul 1, 2026 |
| CVE-2026-56148 | MEDIUM | 6.5 | 0.47% | — | 9.1 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). … | Jul 1, 2026 |
| CVE-2026-56148 | MEDIUM | 6.5 | 0.47% | — | 9.2 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). … | Jul 1, 2026 |
| CVE-2025-68390 | MEDIUM | 4.9 | 0.37% | — | 9.1 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with sna… | Dec 18, 2025 |
| CVE-2025-68390 | MEDIUM | 4.9 | 0.37% | — | 9.2 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with sna… | Dec 18, 2025 |
| CVE-2025-68390 | MEDIUM | 4.9 | 0.37% | — | 9.0 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with sna… | Dec 18, 2025 |
| CVE-2025-68384 | MEDIUM | 6.5 | 0.32% | — | 9.1 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated… | Dec 18, 2025 |
| CVE-2025-68384 | MEDIUM | 6.5 | 0.32% | — | 9.2 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated… | Dec 18, 2025 |
| CVE-2025-68384 | MEDIUM | 6.5 | 0.32% | — | 9.0 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated… | Dec 18, 2025 |
| CVE-2025-37731 | MEDIUM | 6.8 | 0.19% | — | 9.1 | Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certifica… | Dec 15, 2025 |
| CVE-2025-37731 | MEDIUM | 6.8 | 0.19% | — | 9.0 | Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certifica… | Dec 15, 2025 |
| CVE-2025-37731 | MEDIUM | 6.8 | 0.19% | — | 9.2 | Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certifica… | Dec 15, 2025 |
| CVE-2025-37727 | MEDIUM | 5.7 | 0.24% | — | 9.0 | Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preco… | Oct 10, 2025 |
| CVE-2025-37727 | MEDIUM | 5.7 | 0.24% | — | 9.1 | Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preco… | Oct 10, 2025 |
Add a Elasticsearch 9 EOL badge to your README
Show your users which Elasticsearch version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/elasticsearch/9)Frequently asked questions
Is Elasticsearch 9 end of life?
Partially. 4 of the 6 Elasticsearch 9.x releases have reached end of life. Still supported: 9.5, 9.4.
What CVEs affect Elasticsearch 9?
There are 43 CVEs tracked for Elasticsearch 9.x. See the full list above with CVSS and EPSS scores.
What is the latest Elasticsearch 9 version?
The latest Elasticsearch 9.x patch release is 9.5.5, released on October 6, 2026. Always run the latest patch to benefit from all security fixes.
When was Elasticsearch 9 first released?
Elasticsearch 9.0 was released on April 15, 2025. See the full version timeline in the table above.
Is it safe to run Elasticsearch 9 in production?
Only on a supported release (9.5, 9.4). Make sure you run the latest patch (9.5.5) to have all security fixes applied.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA