What’s Vulnerable › Products
Elasticsearch vulnerabilities
91 known vulnerabilities, 2 confirmed exploited in the wild (CISA KEV), 53 published in the last 12 months.
Check whether your Elasticsearch version is affected
Exploited Elasticsearch vulnerabilities
- CVE-2015-1427 — Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability
- CVE-2014-3120 — Elasticsearch Remote Code Execution Vulnerability
Latest Elasticsearch vulnerabilities
- CVE-2026-103009 — Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure (CVSS 7.1)
- CVE-2026-103008 — Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- CVE-2026-103007 — Incorrect Authorization in Elasticsearch Leading to Privilege Escalation (CVSS 7.2)
- CVE-2026-103006 — Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- CVE-2026-103005 — Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- CVE-2026-102411 — Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- CVE-2026-102409 — Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- CVE-2026-102408 — Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service (CVSS 4.3)
- CVE-2026-102407 — Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification (CVSS 5.4)
- CVE-2026-102404 — Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- CVE-2026-94408 — Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service (CVSS 4.9)
- CVE-2026-94399 — Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service (CVSS 6.5)
- CVE-2026-94398 — Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service (CVSS 6.5)
- CVE-2026-94397 — Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service (CVSS 6.5)
- CVE-2026-94396 — Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service (CVSS 6.5)
- CVE-2026-82300 — Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- CVE-2026-82294 — Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- CVE-2026-78607 — Missing Authorization in Elasticsearch Leading to Information Disclosure (CVSS 7.1)
- CVE-2026-78605 — Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure (CVSS 5.9)
- CVE-2026-72649 — Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution (CVSS 8.8)
- CVE-2026-56143 — Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service (CVSS 4.9)
- CVE-2026-72687 — Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- CVE-2026-72686 — Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (CVSS 6.5)
- CVE-2026-72685 — Inefficient Algorithmic Complexity in Elasticsearch Leading to Denial of Service (CVSS 4.3)
- CVE-2026-72684 — Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service (CVSS 6.5)