Elastic Elasticsearch
87 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-103009 | 8.13.0 – 8.19.22 ; 9.0.0 – 9.4.7 ; 9.5.0 – 9.5.4 | Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure | HIGH 7.1 | 0.2 % | ||
| CVE-2026-103008 | 8.12.0 – 8.19.22 ; 9.0.0 – 9.4.7 ; 9.5.0 – 9.5.4 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-103007 | 8.16.0 – 8.19.21 ; 9.0.0 – 9.4.6 ; 9.5.0 – 9.5.3 | Incorrect Authorization in Elasticsearch Leading to Privilege Escalation | HIGH 7.2 | 0.3 % | ||
| CVE-2026-103006 | 8.0.0 – 8.19.20 ; 9.0.0 – 9.4.5 ; 9.5.0 – 9.5.1 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-103005 | 8.12.0 – 8.19.22 ; 9.0.0 – 9.3.8 ; 9.4.0 – 9.4.7 ; … | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-102411 | 8.0.0 – 8.19.22 ; 9.0.0 – 9.4.6 ; 9.5.0 – 9.5.2 | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-102409 | 9.2.0 – 9.2.8 ; 9.3.0 – 9.3.8 ; 9.4.0 – 9.4.7 ; … | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-102408 | 8.19.0 – 8.19.21 ; 9.1.0 – 9.3.8 ; 9.4.0 – 9.4.7 ; … | Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-102407 | 7.17.5 – 7.17.29 ; 8.2.2 – 8.19.18 ; 9.0.0 – 9.3.7 ; … | Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-102404 | 8.0.0 – 8.19.22 ; 9.0.0 – 9.4.7 ; 9.5.0 – 9.5.4 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-94408 | 8.0.0 – 8.19.21 ; 9.0.0 – 9.4.6 ; 9.5.0 – 9.5.2 | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service | MEDIUM 4.9 | 0.3 % | ||
| CVE-2026-94397 | 8.0.0 – 8.19.21 ; 9.0.0 – 9.4.6 ; 9.5.0 – 9.5.3 | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-94396 | 9.2.0 – 9.4.6 ; 9.5.0 – 9.5.3 | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-94399 | 8.0.0 – 8.19.21 ; 9.0.0 – 9.4.6 ; 9.5.0 – 9.5.3 | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-94398 | 8.12.0 – 8.19.21 ; 9.0.0 – 9.4.6 ; 9.5.0 – 9.5.3 | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-82300 | 8.0.0 – 8.19.21 ; 9.0.0 – 9.4.6 ; 9.5.0 – 9.5.3 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-82294 | 8.0.0 – 8.19.20 ; 9.0.0 – 9.4.5 ; 9.5.0 – 9.5.2 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-78607 | 8.0.0 – 8.19.18 ; 9.0.0 – 9.3.7 ; 9.4.0 – 9.4.3 ; … | Missing Authorization in Elasticsearch Leading to Information Disclosure | HIGH 7.1 | 0.3 % | ||
| CVE-2026-78605 | 8.18.0 – 8.19.19 ; 9.0.0 – 9.4.4 ; 9.5.0 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-72649 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.4.4 ; 9.5.0 | Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution | HIGH 8.8 | 0.9 % | ||
| CVE-2026-56143 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.2.8 | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service | MEDIUM 4.9 | 0.4 % | ||
| CVE-2026-72636 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.4.4 | Uncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of Service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-72642 | 8.19.0 – 8.19.19 ; 9.4.0 – 9.4.4 ; 9.5.0 | Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process | HIGH 8.8 | 0.6 % | ||
| CVE-2026-72639 | 8.19.0 – 8.19.19 ; 9.3.0 – 9.5.0 | Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-72638 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.4.4 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-72647 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.4.4 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-72645 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.4.4 ; 9.5.0 | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-72656 | 8.11.0 – 8.17.9 | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-72679 | 8.19.0 – 8.19.19 ; 9.0.0 – 9.4.4 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-72678 | 8.19.0 – 8.19.19 ; 9.4.0 – 9.4.4 ; 9.5.0 | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-72687 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.4.4 ; 9.5.0 | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-72686 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.4.4 ; 9.5.0 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.6 % | ||
| CVE-2026-72685 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.4.4 | Inefficient Algorithmic Complexity in Elasticsearch Leading to Denial of Service | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-72684 | 8.0.0 – 8.19.19 ; 9.0.0 – 9.4.4 | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-72683 | 5.0.0 – 8.19.18 ; 9.3.0 – 9.3.7 ; 9.4.0 – 9.4.3 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.6 % | ||
| CVE-2026-63263 | 9.4.0 – 9.4.3 ; 9.0.0 – 9.3.7 ; 8.0.0 – 8.19.18 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-63144 | 9.4.0 – 9.4.3 ; 9.3.0 – 9.3.7 ; 8.19.0 – 8.19.18 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-63140 | 9.0.0 – 9.3.7 ; 9.4.0 – 9.4.3 ; 8.0.0 – 8.19.18 | Reachable Assertion in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-63136 | 8.0.0 – 8.19.14 ; 9.3.0 – 9.3.3 ; 9.0.0 – 9.2.8 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-56145 | 9.4.0 – 9.4.3 ; 8.0.0 – 8.19.17 ; 9.0.0 – 9.3.6 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-56144 | 9.4.0 – 9.4.3 ; 9.0.0 – 9.3.7 ; 8.12.0 – 8.19.18 | Incorrect Authorization in Elasticsearch Leading to Information Disclosure | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-49090 | 8.0.0 – 8.14.3 ; 7.0.0 – 7.17.23 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-56149 | 9.4.0 – 9.4.2 ; 9.0.0 – 9.3.5 ; 8.0.0 – 8.19.16 | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service | MEDIUM 4.9 | 0.5 % | ||
| CVE-2026-56148 | 9.4.0 – 9.4.2 ; 9.0.0 – 9.3.5 ; 8.0.0 – 8.19.16 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | MEDIUM 6.5 | 0.5 % | ||
| CVE-2025-68390 | 7.0.0 – 7.17.29 ; 8.0.0 – 8.19.7 ; 9.0.0 – 9.1.7 ; … | Elasticsearch Allocation of Resources Without Limits or Throttling | MEDIUM 4.9 | 0.4 % | ||
| CVE-2025-68384 | 7.0.0 – 7.17.29 ; 8.0.0 – 8.19.8 ; 9.0.0 – 9.1.8 ; … | Elasticsearch Allocation of Resources Without Limits or Throttling | MEDIUM 6.5 | 0.3 % | ||
| CVE-2025-37731 | 7.0.0 – 7.17.29 ; 8.0.0 – 8.19.7 ; 9.0.0 – 9.1.7 ; … | Elasticsearch Improper Authentication | HIGH 7.4 | 0.2 % | ||
| CVE-2025-37727 | 7.0.0 – 7.17.29 ; 8.0.0 – 8.18.7 ; 8.19.0 – 8.19.4 ; … | Elasticsearch Insertion of sensitive information in log file | MEDIUM 5.7 | 0.2 % | ||
| CVE-2024-52979 | 7.17.0 – < 7.17.25 ; 8.0.0 – < 8.16.0 | Elasticsearch Uncontrolled Resource Consumption vulnerability | HIGH 7.5 | 0.6 % | ||
| CVE-2024-52981 | 7.17.0 – 7.17.23 ; 8.0 – 8.15.0 | An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection o | HIGH 7.5 | 0.6 % | ||
| CVE-2024-52980 | 7.17.0 – 8.15.0 | Elasticsearch Uncontrolled Resource Consumption vulnerability | MEDIUM 6.5 | 0.5 % | ||
| CVE-2024-43709 | 7.17.0, 8.0.0 – < 7.17.21, 8.13.3 | Elasticsearch allocation of resources without limits or throttling leads to crash | HIGH 7.5 | 0.6 % | ||
| CVE-2024-12539 | 8.16.0 – 8.16.1 | Elasticsearch Incorrect Authorization | MEDIUM 6.0 | 0.5 % | ||
| CVE-2024-23444 | 7.x – < 7.17.23 ; 8.x – < 8.13.0 | Elasticsearch elasticsearch-certutil csr fails to encrypt private key | HIGH 7.5 | 0.2 % | ||
| CVE-2023-49921 | 7.0.0 – < 7.17.16 ; 8.0.0 – < 8.11.2 | An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw c | MEDIUM 6.5 | 0.4 % | ||
| CVE-2024-37280 | 8.13.1 – 8.13.4 | Elasticsearch StackOverflow vulnerability | MEDIUM 4.9 | 0.6 % | ||
| CVE-2024-23445 | 8.10.0 – < 8.14.0 | Elasticsearch Remote Cluster Search Cross Cluster API Key insufficient restrictions | MEDIUM 6.5 | 0.5 % | ||
| CVE-2024-23449 | 8.4.0 – < 8.11.1 | Elasticsearch Uncaught Exception | MEDIUM 5.3 | 0.7 % | ||
| CVE-2024-23451 | 8.10.0 – < 8.13.0 | Elasticsearch Incorrect Authorization in the Remote Cluster Security API key based security model | MEDIUM 6.5 | 0.5 % | ||
| CVE-2024-23450 | 7.0.0 – < 7.17.19 ; 8.0.0 – < 8.13.0 | Elasticsearch Uncontrolled Resource Consumption vulnerability | HIGH 7.5 | 1.3 % | ||
| CVE-2023-46673 | 7.0.0 – < 7.17.14 ; 8.0.0 – < 8.10.3 | It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when | HIGH 7.5 | 0.8 % | ||
| CVE-2021-37937 | 7.13.0 – < 7.14.0 | Elasticsearch privilege escalation | HIGH 8.8 | 0.7 % | ||
| CVE-2023-31417 | 7.0.0 – < 7.17.12 ; 8.0.0 – < 8.9.1 | Elasticsearch Insertion of sensitive information in audit logs | MEDIUM 4.4 | 0.2 % | ||
| CVE-2023-31418 | 7.17.12 ; 8.0.0 – < 8.8.2 ; 2.13.3 – < 3.6.0 | Elasticsearch uncontrolled resource consumption | HIGH 7.5 | 2.1 % | ||
| CVE-2023-31419 | 7.0.0 – < 7.17.12 ; 8.0.0 – < 8.9.0 | Elasticsearch StackOverflow vulnerability | HIGH 7.5 | 61 % | ||
| CVE-2022-23712 | versions 8.0.0 through 8.2.0 | A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an | HIGH 7.5 | 7.5 % | ||
| CVE-2022-23708 | Versions 7.16.0 through 7.17.0 | A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built pro | MEDIUM 4.3 | 1.0 % | ||
| CVE-2021-22147 | versions 7.11.0 to 7.13.4 | Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated use | MEDIUM 6.5 | 1.0 % | ||
| CVE-2021-22145 | 7.10.0 – 7.13.3 | A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitr | MEDIUM 6.5 | 76 % | ||
| CVE-2021-22138 | after 6.4.0 and before 6.8.15 and 7.12.0 | In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When sp | LOW 3.7 | 0.5 % | ||
| CVE-2021-22137 | before 7.11.2 and 6.8.15 | In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Searc | MEDIUM 5.3 | 1.2 % | ||
| CVE-2021-22135 | before 7.11.2 and 6.8.15 | Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API | MEDIUM 5.3 | 1.3 % | ||
| CVE-2021-22134 | after 7.6.0 and before 7.11.0 | A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. | MEDIUM 4.3 | 1.1 % | ||
| CVE-2020-7021 | before 7.10.0 and 6.8.14 | Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is | MEDIUM 4.9 | 1.5 % | ||
| CVE-2021-22132 | 7.7.0 to 7.10.1 | Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search wil | MEDIUM 4.8 | 1.2 % | ||
| CVE-2020-7020 | before 6.8.13 and 7.9.2 | Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search quer | LOW 3.1 | 1.1 % | ||
| CVE-2020-7019 | before 7.9.0 | In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a u | MEDIUM 6.5 | 1.4 % | ||
| CVE-2020-7014 | 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 | The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege esca | HIGH 8.8 | 1.7 % | ||
| CVE-2020-7009 | All versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 | Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create A | HIGH 8.8 | 1.9 % | ||
| CVE-2019-7619 | 7.0.0, 7.0.1, 7.1.0, 7.1.1, 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.3.2, 6.7.0, 6.7.1, 6.7.2, 6.8.0, 6.8.1, 6.8.2, 6.8.3 | Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated a | MEDIUM 5.3 | 2.4 % | ||
| CVE-2019-7614 | before 7.2.1 and 6.8.2 | A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with | MEDIUM 5.9 | 1.0 % | ||
| CVE-2019-7611 | before 5.6.15 and 6.6.1 | A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are dis | HIGH 8.1 | 2.1 % | ||
| CVE-2018-17247 | 6.5.0 and 6.5.1 | Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing exte | MEDIUM 5.9 | 1.4 % | ||
| CVE-2018-17244 | 6.4.0 to 6.4.2 | Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Dir | MEDIUM 6.5 | 1.5 % | ||
| CVE-2018-3831 | before 5.6.12 and 6.4.1 | Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured vi | HIGH 8.8 | 2.0 % | ||
| CVE-2018-3827 | before 6.3.0 | A sensitive data disclosure flaw was found in the Elasticsearch repository-azure (formerly elasticsearch-cloud-azure) plugin. When the repos | HIGH 8.1 | 1.0 % | ||
| CVE-2018-3826 | 6.0.0-beta1 to 6.2.4 | In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API. When the access_key and security_key parame | MEDIUM 6.5 | 0.7 % |