Elasticsearch 8.13.1 → 8.19.22

63 releases · 0 breaking changes · 49 security fixes · 39 advisories fixed

49security0breaking0deprecated0feature0fix

Is 8.13.1 affected? · What changed up to 9.5.5

Vulnerabilities fixed by this upgrade

6.5 CVE-2026-103006 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch…
5.4 CVE-2026-102407 Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user wi…
6.5 CVE-2026-94397 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
6.5 CVE-2026-94398 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
6.5 CVE-2026-94399 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
4.9 CVE-2026-94408 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
6.5 CVE-2026-82294 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
6.5 CVE-2026-82300 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
5.4 CVE-2026-78607 Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges…
8.8 CVE-2026-72649 Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model art…
4.9 CVE-2026-56143 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a sp…
6.5 CVE-2026-72684 A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific…
4.3 CVE-2026-72685 A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document o…
6.5 CVE-2026-72686 A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a rec…
6.5 CVE-2026-72687 A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier befo…
6.5 CVE-2026-72683 A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation…
6.5 CVE-2026-72647 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only read privileges on a single…
6.5 CVE-2026-72656 Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user able t…
6.5 CVE-2026-72636 Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns ag…
6.5 CVE-2026-72638 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions…
6.5 CVE-2026-72645 Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only read privileges on a si…
6.5 CVE-2026-63263 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to…
6.5 CVE-2026-63140 Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query…
6.5 CVE-2026-63136 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search…
5.3 CVE-2026-56144 Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By…
6.5 CVE-2026-56145 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL s…
6.5 CVE-2026-49090 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk request…
6.5 CVE-2026-56148 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excess…
4.9 CVE-2026-56149 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a sp…
4.9 CVE-2025-68390 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory…
6.5 CVE-2025-68384 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial o…
6.8 CVE-2025-37731 Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate s…
5.7 CVE-2025-37727 Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/do…
6.5 CVE-2024-52979 Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to…
4.9 CVE-2024-52981 An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.
6.5 CVE-2024-52980 A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elasticsearch node to crash. A successful…
6.5 CVE-2024-43709 An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function.
4.9 CVE-2024-37280 A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of “passthrough” type. Under certain circumstances, ingesting documents…
6.5 CVE-2024-23445 It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/reference/8.14/security-api-create-cross-cluster-api-key.html#security-api-create-cross-cluster-api-…

Breaking changes

None in the release notes.

Security changes

security Fixes CVE-2026-103007: Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticse… in 8.19.22
security Fixes CVE-2026-94397: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) in 8.19.22
security Fixes CVE-2026-94398: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) in 8.19.22
security Fixes CVE-2026-94399: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) in 8.19.22
security Fixes CVE-2026-82300: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). in 8.19.22
security Fixes CVE-2026-94408: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) in 8.19.22
security Fixes CVE-2026-102408: Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunk… in 8.19.22
security Fixes CVE-2026-103006: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch… in 8.19.21
security Fixes CVE-2026-82294: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). in 8.19.21
security Fixes CVE-2026-72649: Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model art… in 8.19.20
security Fixes CVE-2026-72642: The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model,… in 8.19.20
security Fixes CVE-2026-72684: A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific… in 8.19.20
security Fixes CVE-2026-72686: A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a rec… in 8.19.20
security Fixes CVE-2026-72687: A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier befo… in 8.19.20
security Fixes CVE-2026-72678: Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read pri… in 8.19.20
security Fixes CVE-2026-72679: Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that e… in 8.19.20
security Fixes CVE-2026-72647: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only read privileges on a single… in 8.19.20
security Fixes CVE-2026-72636: Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns ag… in 8.19.20
security Fixes CVE-2026-72638: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions… in 8.19.20
security Fixes CVE-2026-72639: Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit brea… in 8.19.20
security Fixes CVE-2026-72645: Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only read privileges on a si… in 8.19.20
security Fixes CVE-2026-78605: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy dep… in 8.19.20
security Fixes CVE-2026-56143: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a sp… in 8.19.20
security Fixes CVE-2026-72685: A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document o… in 8.19.20
security Fixes CVE-2026-72683: A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation… in 8.19.19
security Fixes CVE-2026-63263: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to… in 8.19.19
security Fixes CVE-2026-63144: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index… in 8.19.19
security Fixes CVE-2026-63140: Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query… in 8.19.19
security Fixes CVE-2026-102407: Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user wi… in 8.19.19
security Fixes CVE-2026-78607: Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges… in 8.19.19
security Fixes CVE-2026-56145: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL s… in 8.19.18
security Fixes CVE-2026-56144: Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By… in 8.19.18
security Fixes CVE-2026-56148: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excess… in 8.19.17
security Fixes CVE-2026-56149: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a sp… in 8.19.17
security Fixes CVE-2026-63136: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search… in 8.19.15
security Fixes CVE-2025-68384: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial o… in 8.19.9
security Fixes CVE-2025-37731: Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate s… in 8.19.8
security Fixes CVE-2025-68390: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory… in 8.19.8
security Fixes CVE-2025-37727: Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/do… in 8.19.5
security Fixes CVE-2025-37727: Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/do… in 8.18.8
security Fixes CVE-2026-72656: Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user able t… in 8.18.0
security Fixes CVE-2024-12539: An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to do… in 8.16.2
security Fixes CVE-2024-52979: Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to… in 8.16.0
security Fixes CVE-2024-52980: A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elasticsearch node to crash. A successful… in 8.15.1
security Fixes CVE-2024-52981: An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow. in 8.15.1
security Fixes CVE-2026-49090: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk request… in 8.15.0
security Fixes CVE-2024-23445: It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/reference/8.14/security-api-create-cross-cluster-api-key.html#security-api-create-cross-cluster-api-… in 8.14.0
security Fixes CVE-2024-37280: A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of “passthrough” type. Under certain circumstances, ingesting documents… in 8.14.0
security Fixes CVE-2024-43709: An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function. in 8.13.3

Every release in between

8.19.22 Sep 23, 2026 Release notes ↗

securityFixes CVE-2026-103007: Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticse…

securityFixes CVE-2026-94397: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

securityFixes CVE-2026-94398: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

securityFixes CVE-2026-94399: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

securityFixes CVE-2026-82300: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).

securityFixes CVE-2026-94408: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

securityFixes CVE-2026-102408: Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunk…

8.19.21 Sep 1, 2026 Release notes ↗

securityFixes CVE-2026-103006: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch…

securityFixes CVE-2026-82294: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).

8.19.20 Aug 11, 2026 Release notes ↗

securityFixes CVE-2026-72649: Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model art…

securityFixes CVE-2026-72642: The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model,…

securityFixes CVE-2026-72684: A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific…

securityFixes CVE-2026-72686: A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a rec…

securityFixes CVE-2026-72687: A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier befo…

securityFixes CVE-2026-72678: Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read pri…

securityFixes CVE-2026-72679: Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that e…

securityFixes CVE-2026-72647: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only read privileges on a single…

securityFixes CVE-2026-72636: Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns ag…

securityFixes CVE-2026-72638: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions…

securityFixes CVE-2026-72639: Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit brea…

securityFixes CVE-2026-72645: Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only read privileges on a si…

securityFixes CVE-2026-78605: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy dep…

securityFixes CVE-2026-56143: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a sp…

securityFixes CVE-2026-72685: A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document o…

8.19.19 Jul 21, 2026 Release notes ↗

securityFixes CVE-2026-72683: A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation…

securityFixes CVE-2026-63263: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to…

securityFixes CVE-2026-63144: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index…

securityFixes CVE-2026-63140: Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query…

securityFixes CVE-2026-102407: Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user wi…

securityFixes CVE-2026-78607: Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges…

8.19.18 Jun 30, 2026 Release notes ↗

securityFixes CVE-2026-56145: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL s…

securityFixes CVE-2026-56144: Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By…

8.19.17 Jun 23, 2026 Release notes ↗

securityFixes CVE-2026-56148: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excess…

securityFixes CVE-2026-56149: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a sp…

8.19.16 May 28, 2026 Release notes ↗

8.19.15 Apr 30, 2026 Release notes ↗

securityFixes CVE-2026-63136: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search…

8.19.14 Apr 8, 2026 Release notes ↗

8.19.13 Mar 19, 2026 Release notes ↗

8.19.12 Feb 26, 2026 Release notes ↗

8.19.11 Feb 3, 2026 Release notes ↗

8.19.10 Jan 13, 2026 Release notes ↗

8.19.9 Dec 19, 2025 Release notes ↗

securityFixes CVE-2025-68384: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial o…

8.19.8 Dec 2, 2025 Release notes ↗

securityFixes CVE-2025-37731: Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate s…

securityFixes CVE-2025-68390: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory…

8.19.7 Nov 11, 2025 Release notes ↗

8.19.6 Oct 23, 2025 Release notes ↗

8.19.5 Oct 6, 2025 Release notes ↗

securityFixes CVE-2025-37727: Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/do…

8.19.4 Sep 18, 2025 Release notes ↗

8.19.3 Aug 28, 2025 Release notes ↗

8.19.2 Aug 12, 2025 Release notes ↗

8.19.1 Aug 7, 2025 Release notes ↗

8.19.0 Jul 29, 2025 Release notes ↗

8.18.8 Oct 6, 2025 Release notes ↗

8.18.7 Sep 16, 2025 Release notes ↗

8.18.6 Aug 28, 2025 Release notes ↗

8.18.5 Aug 12, 2025 Release notes ↗

8.18.4 Jul 22, 2025 Release notes ↗

8.18.3 Jun 24, 2025 Release notes ↗

8.18.2 May 29, 2025 Release notes ↗

8.18.1 May 6, 2025 Release notes ↗

8.18.0 Apr 15, 2025 Release notes ↗

securityFixes CVE-2026-72656: Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user able t…

8.17.10 Aug 12, 2025 Release notes ↗

8.17.9 Jul 22, 2025 Release notes ↗

8.17.8 Jun 24, 2025 Release notes ↗

8.17.7 Jun 3, 2025 Release notes ↗

8.17.6 May 6, 2025 Release notes ↗

8.17.5 Apr 15, 2025 Release notes ↗

8.17.4 Mar 25, 2025 Release notes ↗

8.17.3 Mar 4, 2025 Release notes ↗

8.17.2 Feb 11, 2025 Release notes ↗

8.17.1 Jan 21, 2025 Release notes ↗

8.17.0 Dec 12, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/elasticsearch Release notes: https://www.elastic.co/guide/en/elasticsearch/reference/8.17/release-notes-8.17.0.html

8.16.6 Mar 25, 2025 Release notes ↗

8.16.5 Mar 4, 2025 Release notes ↗

8.16.4 Feb 11, 2025 Release notes ↗

8.16.3 Jan 21, 2025 Release notes ↗

otherDownloads: https://elastic.co/downloads/elasticsearch Release notes: https://www.elastic.co/guide/en/elasticsearch/reference/8.16/release-notes-8.16.3.html

8.16.2 Dec 17, 2024 Release notes ↗

securityFixes CVE-2024-12539: An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to do…

otherDownloads: https://elastic.co/downloads/elasticsearch Release notes: https://www.elastic.co/guide/en/elasticsearch/reference/8.16/release-notes-8.16.2.html

8.16.1 Nov 22, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/elasticsearch Release notes: https://www.elastic.co/guide/en/elasticsearch/reference/8.16/release-notes-8.16.1.html

8.16.0 Nov 12, 2024 Release notes ↗

securityFixes CVE-2024-52979: Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to…

otherDownloads: https://elastic.co/downloads/elasticsearch Release notes: https://www.elastic.co/guide/en/elasticsearch/reference/8.16/release-notes-8.16.0.html

8.15.5 Nov 26, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/elasticsearch Release notes: https://www.elastic.co/guide/en/elasticsearch/reference/8.15/release-notes-8.15.5.html

8.15.4 Nov 12, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/elasticsearch Release notes: https://www.elastic.co/guide/en/elasticsearch/reference/8.15/release-notes-8.15.4.html

8.15.3 Oct 17, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/elasticsearch Release notes: https://www.elastic.co/guide/en/elasticsearch/reference/8.15/release-notes-8.15.3.html

8.15.2 Sep 26, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/elasticsearch Release notes: https://www.elastic.co/guide/en/elasticsearch/reference/8.15/release-notes-8.15.2.html

8.15.1 Sep 5, 2024 Release notes ↗

securityFixes CVE-2024-52980: A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elasticsearch node to crash. A successful…

securityFixes CVE-2024-52981: An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.

otherDownloads: https://elastic.co/downloads/elasticsearch Release notes: https://www.elastic.co/guide/en/elasticsearch/reference/8.15/release-notes-8.15.1.html

8.15.0 Aug 8, 2024 Release notes ↗

securityFixes CVE-2026-49090: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk request…

otherDownloads: https://elastic.co/downloads/elasticsearch Release notes: https://www.elastic.co/guide/en/elasticsearch/reference/8.15/release-notes-8.15.0.html

8.14.3 Jul 11, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/elasticsearch Release notes: https://www.elastic.co/guide/en/elasticsearch/reference/8.14/release-notes-8.14.3.html

8.14.2 Jul 4, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/elasticsearch Release notes: https://www.elastic.co/guide/en/elasticsearch/reference/8.14/release-notes-8.14.2.html

8.14.1 Jun 12, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/elasticsearch Release notes: https://www.elastic.co/guide/en/elasticsearch/reference/8.14/release-notes-8.14.1.html

8.14.0 Jun 5, 2024 Release notes ↗

securityFixes CVE-2024-23445: It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/reference/8.14/security-api-create-cross-cluster-api-key.html#security-api-create-cross-cluster-api-…

securityFixes CVE-2024-37280: A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of “passthrough” type. Under certain circumstances, ingesting documents…

otherDownloads: https://elastic.co/downloads/elasticsearch Release notes: https://www.elastic.co/guide/en/elasticsearch/reference/8.14/release-notes-8.14.0.html

8.13.4 May 14, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/elasticsearch Release notes: https://www.elastic.co/guide/en/elasticsearch/reference/8.13/release-notes-8.13.4.html

8.13.3 May 3, 2024 Release notes ↗

securityFixes CVE-2024-43709: An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function.

otherDownloads: https://elastic.co/downloads/elasticsearch Release notes: https://www.elastic.co/guide/en/elasticsearch/reference/8.13/release-notes-8.13.3.html

8.13.2 Apr 8, 2024 Release notes ↗

otherDownloads: https://elastic.co/downloads/elasticsearch Release notes: https://www.elastic.co/guide/en/elasticsearch/reference/8.13/release-notes-8.13.2.html