Elasticsearch: Mehrere Schwachstellen
NEOSEC enrichment — no mirror of the original source
Ein Angreifer kann mehrere Schwachstellen in Elasticsearch ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren oder offenzulegen.
Source: BSI CERT-Bund. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Read the issue at BSI CERT-BundFull advisory
Highbsi:WID-SEC-2026-43254 linked CVEs
Open advisory with all CVEs
More on Elasticsearch
Other advisories
- Not ratedosv:CLSA-2026-1794173294TuxCare security update for org.elasticsearch:elasticsearch (1 CVE)
- Not ratedosv:CLEANSTART-2026-YY93659Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user
- Not ratedosv:CLEANSTART-2026-JY84456Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130)
- Not ratedosv:CLEANSTART-2026-QJ49324flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input
- Not ratedosv:CLEANSTART-2026-ZN27210Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153)
- Not ratedosv:CLEANSTART-2026-XT40213Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query
- Not ratedosv:CLEANSTART-2026-QG75258Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure
- Not ratedosv:CLEANSTART-2026-EO25497Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker
Other news entries
- Elasticsearch: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- Elasticsearch: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- Elasticsearch: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- Elasticsearch: Mehrere Schwachstellen ermöglichen Denial of ServiceVulnerabilityBSI CERT-Bund
- Elasticsearch: Mehrere Schwachstellen ermöglichen Denial of ServiceVulnerabilityBSI CERT-Bund
- Elasticsearch: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- Elasticsearch: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- Elasticsearch und Kibana: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
Source: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4325
ID