Elasticsearch 8.19.12 → 8.19.18

6 releases · 0 breaking changes · 5 security fixes · 5 advisories fixed

5security0breaking0deprecated0feature0fix

Is 8.19.12 affected? · What changed up to 9.5.5

Vulnerabilities fixed by this upgrade

6.5 CVE-2026-63136 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search…
5.3 CVE-2026-56144 Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By…
6.5 CVE-2026-56145 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL s…
6.5 CVE-2026-56148 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excess…
4.9 CVE-2026-56149 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a sp…

Breaking changes

None in the release notes.

Security changes

security Fixes CVE-2026-56145: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL s… in 8.19.18
security Fixes CVE-2026-56144: Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By… in 8.19.18
security Fixes CVE-2026-56148: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excess… in 8.19.17
security Fixes CVE-2026-56149: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a sp… in 8.19.17
security Fixes CVE-2026-63136: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search… in 8.19.15

Every release in between

8.19.18 Jun 30, 2026 Release notes ↗

securityFixes CVE-2026-56145: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL s…

securityFixes CVE-2026-56144: Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By…

8.19.17 Jun 23, 2026 Release notes ↗

securityFixes CVE-2026-56148: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excess…

securityFixes CVE-2026-56149: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a sp…

8.19.16 May 28, 2026 Release notes ↗

8.19.15 Apr 30, 2026 Release notes ↗

securityFixes CVE-2026-63136: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search…

8.19.14 Apr 8, 2026 Release notes ↗

8.19.13 Mar 19, 2026 Release notes ↗