Elasticsearch 9.0.7 → 9.4.2
33 releases · 0 breaking changes · 20 security fixes · 6 advisories fixed
20security0breaking0deprecated296feature527fix
Vulnerabilities fixed by this upgrade
- 4.9 CVE-2026-56143 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a sp…
- 6.5 CVE-2026-63136 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search…
- 4.9 CVE-2025-68390 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory…
- 6.5 CVE-2025-68384 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial o…
- 6.8 CVE-2025-37731 Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate s…
- 5.7 CVE-2025-37727 Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/do…
Breaking changes
None in the release notes.
Security changes
- security Fixes CVE-2026-72683: A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation… in 9.3.8
- security Fixes CVE-2026-63263: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to… in 9.3.8
- security Fixes CVE-2026-63144: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index… in 9.3.8
- security Fixes CVE-2026-63140: Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query… in 9.3.8
- security Fixes CVE-2026-102407: Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user wi… in 9.3.8
- security Fixes CVE-2026-78607: Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges… in 9.3.8
- security Fixes CVE-2026-56145: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL s… in 9.3.7
- security Fixes CVE-2026-56144: Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By… in 9.3.7
- security Fixes CVE-2026-56148: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excess… in 9.3.6
- security Fixes CVE-2026-56149: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a sp… in 9.3.6
- security Fixes CVE-2026-63136: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search… in 9.3.4
- security Fixes CVE-2026-56143: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a sp… in 9.3.0
- security Fixes CVE-2025-68384: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial o… in 9.2.3
- security Fixes CVE-2025-37731: Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate s… in 9.2.2
- security Fixes CVE-2025-68390: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory… in 9.2.2
- security Fixes CVE-2025-68384: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial o… in 9.1.9
- security Fixes CVE-2025-37731: Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate s… in 9.1.8
- security Fixes CVE-2025-68390: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory… in 9.1.8
- security Fixes CVE-2025-37727: Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/do… in 9.1.5
- security Fixes CVE-2025-37727: Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/do… in 9.0.8
Every release in between
featureUpgrade to log4j 2.26.0 #132166 (issue: #132035)
featureAdd EuroBERT and Jina v5 ops to graph validation allowlist #3015
featureBetter error handling regarding quantiles state documents #2894
featureBetter handling of invalid JSON state documents #2895
featureBetter messaging regarding OOM process termination #2841
featureDowngrade log severity for a batch of recoverable errors #2889
featureHarden pytorch_inference with TorchScript model graph validation #3008 (issue: #2890)
featureImprove adherence to memory limits for the bucket gatherer #2848
featureReport the actual memory usage of the autodetect process #2846
featureRestrict file system access for pytorch models #2851
featureUpdate the PyTorch library to version 2.7.1 #2863
featureAdd logging tracking to _xpack/usage #148087
fixAggs: Account aggs uncompressed size on coordinator reduction #148885 (issue: #147190)
fixAggs: Fix auto_date_histogram/date_histogram inside a global agg #147427 (issue: #92570)
fixFix ArrayIndexOutOfBoundsException in date_histogram with hard_bounds outside data #148765 (issue: #148763)
fixFix CCR follow to handle indexing_complete race #145304
fixFix FsBlobContainer.moveBlobAtomic fallback on CIFS filesystems #148777 (issue: #148811)
fixDisallow casting to snapshot-only type #148813 (issue: #147867)
fixFix "optimized incorrectly" error from project reorder #149053 (issue: #148612)
fixFix ArrayIndexOutOfBoundsException in centroid grouping evaluateFinal #148815 (issue: #141318)
fixFix FROM *_logs index name validation #149395 (issue: #146073)
fixFix InvalidMappedField equals/hashCode and lazy error message #146117 (issue: #145907)
fixFix errors in blockloaders when filtering nulls on histograms #148983 (issue: #147854)
fixLucene TermsEnum and PostingsEnum may only be used from acquiring thread #149297
fixNode-reduce driver should not release search contexts on failure #145960 (issue: #145509)
fixNormalize _timeseries to JSON for stored source #148716 (issue: #148414)
fixUse search threadpool for coordination in ES|QL #149034
fixHonor task settings for Amazon Bedrock and Google Vertex chat completion #149268 (issue: #148792)
fix[Inference API] Fix NPE for Inference usage when referencing a embedding task type #149636
fix[Inference API] Fixing potential NPE if InferenceContext is null #148921
fix[Inference API] Use image/jpeg instead of image/jpg for inference validation MIME type #148793
fixPin server-launcher native -march to x86-64-v2 #148542 (issue: #148326)
fixUse toTruncatedString in chunked objects toString #147860 (issue: #143694)
fixMonitor exceptions in processing queries and log them as failures #148362
fixFix flaky CIoManagerTest/testFileIoGood test #3017
fixDefault PromQL index to metrics-* #148489
fixDefault Prometheus discovery APIs to metrics-* #148770
fixFix REPLACE with empty pattern #148616
fixDefault exclude_inference_fields to exclude_vectors at REST #148527 (issue: #146425)
fixFix UOE in CanMatch empty-shards skipped-by-cluster map #148754
+7 more items in the release notesfeatureAdd EuroBERT and Jina v5 ops to graph validation allowlist #3015
featureBetter error handling regarding quantiles state documents #2894
featureBetter handling of invalid JSON state documents #2895
featureBetter messaging regarding OOM process termination #2841
featureDowngrade log severity for a batch of recoverable errors #2889
featureHarden pytorch_inference with TorchScript model graph validation #3008 (issue: #2890)
featureImprove adherence to memory limits for the bucket gatherer #2848
featureReport the actual memory usage of the autodetect process #2846
featureRestrict file system access for pytorch models #2851
featureUpdate the PyTorch library to version 2.7.1 #2863
featureBump bundled JDK to Java 26.0.1 #147424
featureUpdate bundled JDK to Java 26 #146167
featureUpdate elastic-apm-agent-java8 to 1.55.6 #148271
fixUpdate failure store redirect logic to exclude backpressure exceptions #148154
fixBugfix - Block Loader Pushdown + Union Types #147940
fixDisallow empty lists in named params, only #147748 (issue: #147448)
fixES|QL query approximation: enforce minimum number of sampled source rows #147886
fixImplement RerankingInferenceService for Elastic service #148365
fix[Inference API] Fix inference initialization thread exhaustion #147063
fixFix flaky CIoManagerTest/testFileIoGood test #3017
fix[DiskBBQ] Check that precondition should not be overwritten on update #148111 (issue: #148004)
fixFix race in TickerScheduleTriggerEngine by checking watcher to node allocation #147678 (issue: #146874)
featureIt now provides 3x or more better search performance on very restrictive filters (prefilters on centroids)
featureProvides a way to condition non iid vectors (expert API for now)
featureGives more bit options (1, 2, 4, and 7 bits!)
featureMore native code improvements for overall performance
featureAccepts the standard Prometheus range query parameters (query, start, end, step, optional index)
featureTranslates the PromQL expression into an ES|QL PROMQL command and executes it via EsqlQueryAction
featureConverts the columnar ES|QL response into the Prometheus matrix JSON format and returns it to the caller
featureBump heap usage limits for INLINE STATS #144679
featureInject circuit breaker into forked SynonymMapBuilder #144800
featureSupport custom rulesets in analysis-icu/icu-transform plugin #143060
featureAdd Clone API Key endpoint #142633 (issue: #59304)
featureUpdate View CRUD Actions to be Index Actions #141570
feature[Entity Store] Add permissions for Entity Store datastream #145981
featureCPS and project routing support for templated searches #139446
featureDo not mark bulk indexing requests as retried after primary relocations #142157 (issue: #141586)
featureAdd dynamic bloom filter sizing based on document count #141342
featureAdd panama simd implementation of contains function for BinaryDocValuesContainsTermQuery #143922
featureAllow loading BYTE_LENGTH without decompressing Zstd byte ref blocks #141322
featureES819 Binary doc values: compact doc offsets using bit packing #142772
featureEnable large blocks for binary doc values by default. This mainly affects fields of type wildcard, ignored source, values hitting ignore above threshold and ignore malformed numbers and dates. #145216
featureFast codePointCount implementation for BytesRef #140388
featurePush contains binary doc values query down to es819 codec #143898
featureRewrite *substring* wildcard queries to contains term queries for binary doc values keywords #143433
featureTrack bloom filter disk usage in IndexDiskUsageAnalyzer #142106
featureUpgrade zstd to version 1.5.7 #140530
featureUse DirectAccessInput in ZstdDecompressor to avoid intermediate heap copy #145658
featureUse max instead of median for merged bloom filter size #143302
featureCodePointCount implementation using Panama vectors API #140693 (issue: #140567)
featureAdd 'logs.otel' and 'logs.ecs' stream types #141564 (issue: #141040)
featureEnsure DLM only runs one general loop at a time #143883
featureSupport Failure Stores in Cross Cluster Search #139316
featureBatch index creation #144074
featureBatch snapshot update tasks after external change #142091
featureEnsure that synthetic _id is usable after restarts/relocations #138678
featureHealth reports GREEN when provisionally unassigned replica #144773
featureIncrease the per-index limit for merges to half the CPUs #141389
featureOpt-in persistent task reassignment on node shutdown #143306
featureCollect dimensions only once per tsid when downsampling #145089
featureRate calculation for downsampled counters becomes aware of counter resets when the aggregate sampling method is used. #143381 (issue: #136178)
featureUse the tdigest type and compression from TDigest in downsampling #143247
+473 more items in the release notessecurityFixes CVE-2026-72683: A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation…
securityFixes CVE-2026-63263: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to…
securityFixes CVE-2026-63144: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index…
securityFixes CVE-2026-63140: Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query…
securityFixes CVE-2026-102407: Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user wi…
securityFixes CVE-2026-78607: Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges…
featureUpgrade OpenTelemetry in ms-graph-authz #151968
featureImplement watchdog timeout for GROK #152851
featureUpdate the commons-text library version to match commons.lang3 #152092
featureUpgrade Jackson #152163
featureBetter messaging regarding OOM process termination #2841
featureImprove adherence to memory limits for the bucket gatherer #2848
featureReport the actual memory usage of the autodetect process #2846
featureRestrict file system access for pytorch models #2851
featureUpdate the PyTorch library to version 2.7.1 #2863
fixAvoid out-of-memory errors by accounting for memory during the cardinality aggregation reduction phase #152773 (issue: #150290)
fixFix non-monotonic T-Digest centroids caused by floating-point errors #151979
fixFix null pointer exception when aggregation parameter scripts return null #152152 (issue: #136639)
fixFix data stream privilege checking #148179
fixImprove authorization for the simulate bulk action #152148
fixAvoid dense run-length allocation in HyperLogLog #152035
fixFix infinite loop in GeoLineDecomposer dateline crossing checks #152096 (issue: #152066)
fixTranslate tools and tool_choice to Anthropic format for Google Model Garden Anthropic chat completion #152427
fixInclude ingest metadata in self-reference checks #152932
fixAutomatically repair ML anomaly results aliases pointing at a .reindexed-v7 index #147688 (issue: #147686)
fixExtend the anomaly detection results template for reindexed indices and generalize healing beyond job_id mapping #153755 (issue: #147686)
fixFix ML jobs stuck in starting state on Serverless trial projects #150362
fixRoll reindexed ML state indices in daily maintenance #149555
fixAdd defensive protections when parsing query_string #152385
fixApply search timeout to the DFS phase query rewrite #153479
fixApply search timeout to the query rewrite step #153082 (issue: #104187)
fixFork ensureShardSearchActive callbacks off the refresh thread #152509 (issue: #97280)
fixReturn a 400 (Bad Request) for invalid tokens in a script query #152476
fixTrip request breaker on large completion suggest size/shardSize #152552
fixFix snapshot creation on CIFS shares when an access-denied exception occurs #153219 (issue: #152053)
fixIgnore OTLP number data points without a value #152733
fixTighten retry startup logic #152803
securityFixes CVE-2026-56145: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL s…
securityFixes CVE-2026-56144: Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By…
feature[Inference] Add requires org.apache.commons.lang3 to module-info #151794
featureBetter messaging regarding OOM process termination #2841
featureImprove adherence to memory limits for the bucket gatherer #2848
featureReport the actual memory usage of the autodetect process #2846
featureRestrict file system access for pytorch models #2851
featureUpdate the PyTorch library to version 2.7.1 #2863
fixResolve surrogates in union type field resolution before plan serialization #151633 (issue: #151475)
fixPass through includeSourceInError #142335
fixFix bug causing incorrect error on force deleting already deleted model #107188 (issue: #105420)
fixRevert "[ML] Add extra validation in trained_model creation" #152000
securityFixes CVE-2026-56148: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excess…
securityFixes CVE-2026-56149: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a sp…
featureUpdate the built-in kibana_system role to grant manage, create_index, read, index, write, and delete privileges on the axonius.alert_finding and axonius.incident indices, replacing the previous axonius.alert_and_incident index #149797
feature[otel-data] Explicitly map http.response.status_code as long #149631
featureUpgrade commons-lang3 version for the inference plugin #150242
featureBetter messaging regarding OOM process termination #2841
featureImprove adherence to memory limits for the bucket gatherer #2848
featureReport the actual memory usage of the autodetect process #2846
featureRestrict file system access for pytorch models #2851
featureUpdate the PyTorch library to version 2.7.1 #2863
featureUpgrade netty to 4.1.135.Final #151099
featureOptimize literal action automaton builds #151093 (issues: #123872, #105723)
fixFix Nynorsk stemmer UnsupportedOperationException. The light_nynorsk and minimal_nynorsk stemmers no longer fail with an HTTP 500 error during index creation due to passing an immutable map to Lucene's analysis factory. #150345
fixMove SAML metadata resolution to background thread #144381 (issue: #138031)
fixCatch StackOverflowError in deeply nested RLIKE patterns #150238 (issue: #149838)
fixEnforce limit for max nested functions #149971
fixFix wrong warning in expressions with unrolled multivalues #145968
fix[ESQL] Refactor Greatest and Least functions to use evaluator map #128429 (issue: #114036)
fixTruncate error for ILM's step_info instead of string #150413
fixValidate inference embedding model before checking for existing uses #150150 (issues: #147062, #150084)
fixWhen a streaming inference request is canceled, immediately release apache client networking resources #149987
fix[Inference API] Fix Streaming publisher shutdown race condition #150789 (issue: #150742)
fixDon't apply time zones to epoch-based timestamps #148663
fixFilter _source field names by code point #151146
fixFix OS stats for cgroup paths containing colons #151095
fixAdd extra validation in trained_model creation #150227
fixEQL/SQL: Enforce max expression depth checks #150003
fixAdd IT covering search during rolling restart #149667 (issue: #86927)
fixMake Automatons wildcard code-point aware #151143
fixFix OTLP histogram handling for single-count histograms without bucket boundaries #151411
fixHonor ClusterHealth timeout when waiting for transform internal index shards #149462 (issue: #149400)
featureUpgrade to log4j 2.26.0 #132166 (issue: #132035)
featureBetter messaging regarding OOM process termination #2841
featureImprove adherence to memory limits for the bucket gatherer #2848
featureReport the actual memory usage of the autodetect process #2846
featureRestrict file system access for pytorch models #2851
featureUpdate the PyTorch library to version 2.7.1 #2863
featureBump bundled JDK to Java 26.0.1 #147424
featureAdd logging tracking to _xpack/usage #148087
featureUpdate elastic-apm-agent-java8 to 1.55.6 #148271
fixAggs: Account aggs uncompressed size on coordinator reduction #148885 (issue: #147190)
fixAggs: Fix auto_date_histogram/date_histogram inside a global agg #147427 (issue: #92570)
fixFix ArrayIndexOutOfBoundsException in date_histogram with hard_bounds outside data #148765 (issue: #148763)
fixFix CCR follow to handle indexing_complete race #145304
fixUpdate failure store redirect logic to exclude backpressure exceptions #148154
fixFix FsBlobContainer.moveBlobAtomic fallback on CIFS filesystems #148777 (issue: #148811)
fixFix race in FsBlobContainer.moveBlobAtomic by replacing move op with hard link #147405 (issue: #147171)
fixFix management of PIT close failures after successful query #146634 (issues: #146263, #146187)
fixDisallow empty lists in named params, only #147748 (issue: #147448)
fixDo not enable doc-partitioning for count #143544 (issue: #134512)
fixFix ArrayIndexOutOfBoundsException in centroid grouping evaluateFinal #148815 (issue: #141318)
fixFix FROM *_logs index name validation #149395 (issue: #146073)
fixFix _index LIKE with ? wildcard #147462 (issue: #146364)
fixFix deriv aggregation function intermediate state #146160 (issue: #141305)
fixFix errors in blockloaders when filtering nulls on histograms #148983 (issue: #147854)
fixFix nullify under join and enrich #145743 (issue: #141827)
fixNode-reduce driver should not release search contexts on failure #145960 (issue: #145509)
fixNormalize _timeseries to JSON for stored source #148716 (issue: #148414)
fixReport correct location for SET errors #147582 (issue: #145873)
fixRestore TEXT field size estimate for Enrich and LookupJoin #147357
fixUse search threadpool for coordination in ES|QL #149034
fixHonor task settings for Amazon Bedrock and Google Vertex chat completion #149268 (issue: #148792)
fixImplement RerankingInferenceService for Elastic service #148365
fixMake similarity required for SageMaker ElasticTextEmbeddingPayload #146885
fix[Inference API] Fix inference initialization thread exhaustion #147063
fix[Inference API] Fixing potential NPE if InferenceContext is null #148921
fix[Inference API] Use image/jpeg instead of image/jpg for inference validation MIME type #148793
fixFix potential OOME on SearchResponse#toString() for extemely large responses #147267
fixUse toTruncatedString in chunked objects toString #147860 (issue: #143694)
fixPreserve zero-allocation trained-model deployments in cluster state during ML-node shutdown rebalances #146910 (issue: #146806)
fixFix REPLACE with empty pattern #148616
+13 more items in the release notessecurityFixes CVE-2026-63136: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search…
featureBump heap usage limits for INLINE STATS #144679
featureSkip time series field type merge for non-TS agg queries #143262
featureUpdate bundled JDK to Java 26 #146167
fixFix propagation of filters on join keys for missing events #145813 (issue: #145402)
fixDo not discard disjunction conditions when is null/is not null might invalidate them #145941
fixDon't use a Literal for constant_keyword fields when used inside full-text functions #145632 (issue: #145570)
fixESQL - Fix performance loading source when vectors are excluded #146223 (issue: #145799)
fixFix handling of values on the time bucket boundaries for ES|QL increase #145794
fixFix nested fields loading under NULLIFY #145741 (issue: #142616)
fixFix rate/increase single-value bucket handling for delta temporality #146518
fixFix starts_with/ends_with with special chars #146348 (issue: #130851)
fixKeywords mv count fix #145390
fixThrow a 400 error for malformed parsing input when missing element end #145777
fixFix pipeline resolution cache for bulk requests #144648
fixFix waiting for enrich policy execution for users without the monitor privilege #145751
fixOmit uncomputed model stats #146186
fixFix match only text decoding surrogate pairs #146567 (issue: #146538)
fixRestore initial thread context during reindex etc #146134
fixAdd cancellation support to IndicesRequestCache #141708
fixCollapse pathological regex quantifier stacking to prevent NFA construction OOM #145452
fixFix terminate_after not honored for aggs when size=0 #146199 (issue: #126665)
fixFix bug parsing "request" parameter in clear cache API, it should clear the request cache only #145726
fixUse query circuit breaker for wildcard/regexp determinization #145427 (issue: #145128)
fixUse IllegalArgumentException over RepositoryException for readonly-repository checks #140200
fixReplace IllegalStateException with IllegalArgumentException for conflicting time series metadata #142370
fixFix NPE in GPU resource pool when CuVSResources creation fails #146632
fixFix NPE when having double nested field with knn query #146933 (issue: #141830)
fix[DiskBBQ] Fix offHeap size for empty indices #146347
fix[DiskBBQ] Wait for queue saturation in MaxScoreTopKnnCollector #145341
featureSkip automaton construction for literal resource strings in application privilege checks #144685
fixFix ArrayIndexOutOfBoundsException in cat nodes for partial load average arrays #144859
fixCCR follower index needs to copy transport version from CCR leader index #145035
fixCancel async query on expiry #143016 (issue: #142662)
fixDon't over-alloc when unpacking dimension values #144525
fixESQL: Fix incorrectly optimized fork with nullify unmapped_fields #143030 (issue: #142762)
fixESQL: Fix null comparison type checking #140660 (issue: #140460)
fixFix field caps incorrectly synthesizing object parents under subobjects:false passthrough mappers #144183 (issue: #144179)
fixReduce LuceneOperator.Status memory consumption with large QueryDSL queries #143175 (issue: #143164)
fixFix createLDAPCertStore failing in FIPS mode #144453 (issues: #144376, #144377)
fixFix geo_centroid over geo_shape merging multiple shards #144637 (issue: #144504)
fixFix system index mapping update for reindexed indices after migration #144782 (issue: #144764)
fixFix "reset anomaly detection API" crashing when only colliding indices exist #144545 (issue: #144544)
fixLazily create matcher in BinaryDvConfirmedQuery #144698
fixFix ArrayIndexOutOfBoundsException in fetch phase with partial results #144385 (issue: #140495)
fixFix circuit breaker leak in percolator query construction #144827
fixFix request cache invalidation to use ES cache helper consistently #144581
fixFix wrong return value in ContextIndexSearcher.totalTermFreq #144333
fixFix up exception messages in AzureBlobStore #144654
fixFix dense_vector default index options when using BFLOAT16 #145202 (issue: #145204)
fix[DiskBBQ] Fix index sorting on flush #144938
fix[DiskBBQ] Fix index sorting on flush (2nd attempt) #145076
featureBump Kiota Libs #143556
feature[JupiterOne] Add manage, create_index, read, index, write, delete, permission for third party agent indices kibana_system #140049
feature[Sentinel One] Add manage, create_index, read, index, write, delete, permission for third-party agent indices in the Kibana system to support the unified alert data stream. #142648
featureApm-server: update monitor mappings to include new TBS metrics #140700
featureFix nested object float arrays being mapped to dense vectors when they are mapped in dynamic template mappings #143733 (issue: #143732)
featureSkip checkpoint query filter when runtime_mappings are present #142452
fixFix ClassCastException when merging TopHits with mixed sort field types #141919 (issue: #141714)
fixFix: _resolve/index API should be able to accept an empty body #143159
fixApm-data: explicit map of timestamp.us to long #143173
fixExpand DLM user to allow interaction with .workflows-events #143958
fixAccount for missing StubRelation due to SurrogateExpressions replacement #142882 (issue: #142219)
fixESQL - enable zero_terms_query option in MATCH function #143668 (issue: #143070)
fixFix KQL/QSTR with unmapped fields in NULLIFY mode #143399 (issues: #142968, #142959)
fixFix incorrect nullify with unmapped fields #142300 (issue: #141870)
fixFix nullify where in stats #144029 (issue: #143991)
fixFix unresolved name pattern #143210
fixPromptly clean up CCS exchange sinks #143325
fixSkip nullifying aliases for Aggregate groups. #141340
fixTS command ignores aliases in BY #143489
fixFix UnsupportedOperationException when using a plain highlighter with a query on a field used for index sorting (index.sort.*). #143680
fixFix Duplicate ML Model Allocations on Same Node #142872
fixFixed stats API to use correct allocation count for required_native_memory_bytes calculation #143077 (issue: #107831)
fixApply the source filter on metadata field mappers when loading from synthetic source #143726 (issue: #143464)
fixAdd circuit breaker for query construction to prevent OOM from automaton-based queries #142150
fixAdd timeout support for KNN searches in the DFS phase #142925
fixDisable CAE in microsoft-graph-authz plugin #142848 (issue: #142743)
fixFix use-after-free in SearchApplicationIndexService buffer lifecycle #143134
fixFix cancellation race in CancellableRateLimitedFluxIterator #141974
fix[ML]Fix latest transforms disregarding updates when sort and sync fields are non-monotonic #142856 (issue: #90643)
fixFix GPU merge ClassCastException with wrapped directories #143531
featureFix ILM's 'skipping policy' logging level #141890 (issue: #141876)
featureUpdating bundled jdk version to 25.0.2+10 #142500
fixDon't overwrite decision with NOT_PREFERRED unless its an improvement #141565
fixSuppress success callback when failing master task #142042
fixAllow include_source_on_error param on logs streams #141391 (issue: #141360)
fixAvoid a possible NPE by throwing an EIAE instead with more info #141711 (issue: #141267)
fixDeep copy BytesRef when creating a constant vector block #141242 (issues: #140615, #140809, #140621)
fixDynamically grow hash in linear counting in HLL #142047 (issue: #41847)
fixESQL fix TO_IP leading_zeros=octal parsing #141776 (issue: #141627)
fixFix IP_PREFIX function leaking data in scratch #141940 (issue: #141628)
fixFix NPE with null field parameter #142328 (issue: #142281)
fixFix TS bug when grouping on aliases #141568
fixFix bug with multiple spatial aggs filtering in ES|QL #142332 (issue: #142329)
fixFix injected attributes's IDs in UnionAll branches #141262
fixRemove incorrect inline stats pruning #141056 (issues: #140757, #139359)
fix[Inference API] Do not write "task" field in Jina embedding request if unsupported #142181
fix[Inference API] Fix ChunkingSettings field missing from ModelConfigurations equals method #142238
fix[Inference API] Prevent trailing slashes from being included in URLs #141692
fixReindexing older indices with percolator fields clears migration assistant errors #141539
fixFix cluster name in ECS upgrade #141792
fixEvict old models from the cache before loading new #140844
fixReduce locking when persisting ML job statistics #141519 (issue: #140511)
fixAllow shadowing time series metrics and dimension in non time series indexing #141549 (issue: #140882)
fixFixing for NPE when there is no query specified for the standard retriever #142479 (issue: #142336)
fixImplement comprehensive top N parameter handling for text similarity reranker #142039
fixFix QlIllegalArgumentException with non-foldable date range queries #142386 (issue: #137365)
fixEnsure Rewriteable.rewriteAndFetch listeners are not executed on transport threads #141904
fixFix Top Hits Incompatible Field Types on Sort Across Indices #142046 (issue: #141906)
fixFix handling empty collapse construct #141973 (issue: #139299)
fixPrevent large CancelTasksRequest descriptions by truncating nodes and actions #141815
fixReduce cancellation check interval in CancellableBulkScorer for better responsiveness #141747
fixFix built-in roles sync to retry on lock contention instead of silently discarding pending updates #142433
fixEnsure paused shard snapshot can be deleted #141408
fixTerminate GCS retries when node is shutting down #142193
fixTerminate S3 get blob retries when node is shutting down #142186
fixFix transform producing empty dest index when source query references runtime fields #142450 (issue: #113156)
fixFix transform validation to reject PUT and _start when user lacks remote index permissions #142403 (issue: #95367)
fix[GPU] Handle segments too big for MSAI segment access #141872 (issue: #141746)
securityFixes CVE-2026-56143: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a sp…
featureLet terms queries rewrite to a filter on constant_keyword fields #139106
featureAllocation: add balancer round summary as metrics #136043
featureAllocation: add duration and count metrics for write load hotspot #138465
featureIterate directly over contents of RoutingNode #137694
featureShard started reroute high priority #137306
featureSimulate shards moved by explicit commands #136066
featureTrack shardStarted events for simulation in DesiredBalanceComputer #135597
featureAdditional DEBUG logging on authc failures #137941
featureImprove SAML error handling by adding metadata #137598 (issue: #128179)
featureIn-response-to in saml successful response #137599 (issue: #128179)
feature[Axonius] Add manage, create_index, read, index, write, delete, permission for third party agent indices kibana_system #139345
feature[Security Solution] Add additional privileges to Kibana System role for .endpoint-scripts-file* indexes #139245
feature[Security Solution] Add privileges to Kibana System role for management of internal indexes in support of Elastic Defend features #138993
featureAdd support for project_routing for _search and _async_search #137566
featureCPS usage telemetry support #137705
featureCPS: Enable flatworld search and project_routing for _msearch #138822
featureDo not assume we hear back from all linked projects when validating resolved index expressions for CPS #137916
featureMRT should default to true for CPS searches #138105
featureAdd ThreadWatchdog to ClusterApplierService #134361
featureReport recent tasks updates when master starved #139518
featureEnable large numeric blocks for TSDB codec in production #139503
featureImproved bulk loading for binary doc values #138631
featureIntegrate stored fields format bloom filter with synthetic _id #138515
featureSimple bulk loading of compressed binary doc values #138541
featureAdding match_only_text subfield to *.display_name fields in ecs@mappings to be compliant with the latest additions in ECS #136265
featureSupport choosing the downsampling method in data stream lifecycle #137023
featureDisk usage don't include synthetic _id postings #138745
featureTransportGetBasicStatusAction runs on local #137567
featureAdd new sampling method to the Downsample API #136813
featureMove force merge from the downsampling request to the ILM action and allow users to disable it. #135834
featureAccept project_routing as query parameter #138559
featureEnable CPS #137833
featureAdd CHUNK function #134320
featureAdd MV_INTERSECTION Function #139379
featureAdd TOP_SNIPPETS function to return the best snippets for a field #138940
featureAdd TRANGE ES|QL function #136441 (issue: #135599)
featureAdd m alias for minute duration literal #136448 (issue: #135552)
featureAdd time_zone request param support to KQL and QSTR functions #138695
featureAdd optional parameters support to KQL function #135895 (issue: #135823)
+248 more items in the release notesfeatureImprove SAML error handling by adding metadata #137598 (issue: #128179)
featureIn-response-to in saml successful response #137599 (issue: #128179)
featureSkip automaton construction for literal resource strings in application privilege checks #144685
fixFix ArrayIndexOutOfBoundsException in cat nodes for partial load average arrays #144859
fixCCR follower index needs to copy transport version from CCR leader index #145035
fixCancel async query on expiry #143016 (issue: #142662)
fixReduce LuceneOperator.Status memory consumption with large QueryDSL queries #143175 (issue: #143164)
fixFix createLDAPCertStore failing in FIPS mode #144453 (issues: #144376, #144377)
fixFix geo_centroid over geo_shape merging multiple shards #144637 (issue: #144504)
fixFix system index mapping update for reindexed indices after migration #144782 (issue: #144764)
fixFix anomaly detection jobs stuck in opening by continously retrying to set the state to opened. #139668
fix[Inference API] Support chunking settings for sparse embeddings in custom service #138776
fixFix ArrayIndexOutOfBoundsException in fetch phase with partial results #144385 (issue: #140495)
fixFix circuit breaker leak in percolator query construction #144827
fixFix request cache invalidation to use ES cache helper consistently #144581
fixFix wrong return value in ContextIndexSearcher.totalTermFreq #144333
fixFix up exception messages in AzureBlobStore #144654
fix[DiskBBQ] Fix index sorting on flush #144938
fix[DiskBBQ] Fix index sorting on flush (2nd attempt) #145076
fixValidate Watcher Proxy Allowlist #144759
featureBump Kiota Libs #143556
feature[JupiterOne] Add manage, create_index, read, index, write, delete, permission for third party agent indices kibana_system #140049
feature[Sentinel One] Add manage, create_index, read, index, write, delete, permission for third-party agent indices in the Kibana system to support the unified alert data stream. #142648
featureApm-server: update monitor mappings to include new TBS metrics #140700
featureFix nested object float arrays being mapped to dense vectors when they are mapped in dynamic template mappings #143733 (issue: #143732)
featureSkip checkpoint query filter when runtime_mappings are present #142452
fixFix ClassCastException when merging TopHits with mixed sort field types #141919 (issue: #141714)
fixApm-data: explicit map of timestamp.us to long #143173
fixESQL - enable zero_terms_query option in MATCH function #143668 (issue: #143070)
fixPromptly clean up CCS exchange sinks #143325
fixFix Duplicate ML Model Allocations on Same Node #142872
fixFixed stats API to use correct allocation count for required_native_memory_bytes calculation #143077 (issue: #107831)
fixFix QlIllegalArgumentException with non-foldable date range queries #142386 (issue: #137365)
fixAdd circuit breaker for query construction to prevent OOM from automaton-based queries #142150
fixAdd timeout support for KNN searches in the DFS phase #142925
fixDisable CAE in microsoft-graph-authz plugin #142848 (issue: #142743)
fixFix use-after-free in SearchApplicationIndexService buffer lifecycle #143134
fixFix cancellation race in CancellableRateLimitedFluxIterator #141974
fix[ML]Fix latest transforms disregarding updates when sort and sync fields are non-monotonic #142856 (issue: #90643)
featureUpdating bundled jdk version to 25.0.2+10 #142500
fixSuppress success callback when failing master task #142042
fixAvoid a possible NPE by throwing an EIAE instead with more info #141711 (issue: #141267)
fixDeep copy BytesRef when creating a constant vector block #141242 (issues: #140615, #140809, #140621)
fixDynamically grow hash in linear counting in HLL #142047 (issue: #41847)
fixESQL fix TO_IP leading_zeros=octal parsing #141776 (issue: #141627)
fixFix IP_PREFIX function leaking data in scratch #141940 (issue: #141628)
fixFix NPE with null field parameter #142328 (issue: #142281)
fixFix bug with multiple spatial aggs filtering in ES|QL #142332 (issue: #142329)
fix[Inference API] Do not write "task" field in Jina embedding request if unsupported #142181
fix[Inference API] Fix ChunkingSettings field missing from ModelConfigurations equals method #142238
fix[Inference API] Prevent trailing slashes from being included in URLs #141692
fixReindexing older indices with percolator fields clears migration assistant errors #141539
fixFix cluster name in ECS upgrade #141792
fixAdd missing job_id filter to Anomaly Detection data deleter #138160
fixReduce locking when persisting ML job statistics #141519 (issue: #140511)
fixAllow shadowing time series metrics and dimension in non time series indexing #141549 (issue: #140882)
fixFixing for NPE when there is no query specified for the standard retriever #142479 (issue: #142336)
fixImplement comprehensive top N parameter handling for text similarity reranker #142039
fixEnsure Rewriteable.rewriteAndFetch listeners are not executed on transport threads #141904
fixFix Top Hits Incompatible Field Types on Sort Across Indices #142046 (issue: #141906)
fixFix handling empty collapse construct #141973 (issue: #139299)
fixPrevent large CancelTasksRequest descriptions by truncating nodes and actions #141815
fixReduce cancellation check interval in CancellableBulkScorer for better responsiveness #141747
fixEnsure paused shard snapshot can be deleted #141408
fixFix transform producing empty dest index when source query references runtime fields #142450 (issue: #113156)
fixFix transform validation to reject PUT and _start when user lacks remote index permissions #142403 (issue: #95367)
featureBlockSourceReader should always apply source filtering #136438
featureSupport LimitedRole in idp role resolution #140536
featureAdd max_batch_size setting to EIS dense and sparse service settings #141185
featureRetry bulk-delete items in GCS #138951 (issue: #138364)
fixHandle deleted source index in allocation deciders #140699 (issue: #140630)
fixFix _index on missing events in CCS #140886
fixFix folding of case() function with date period and time duration #141157
fixUse sub keyword block loader with ignore_above for text fields #140622
fixRemove ILM-stopped-check before the cluster update in migrateToDataTiersRouting #140892 (issue: #140885)
fix[Inference API] Include rerank in supported tasks for IBM watsonx integration #140331 (issue: #140328)
fixDisallow max_number_of_allocations > 1 for low priority model deployments #140163 (issue: #111227)
fixFix stderr leak in Docker ES process detection #140701
fixDisable _delete_by_query and _update_by_query for CCS/stateful #140301
fixFix date fields sort formatting with missing values #135899 (issue: #81960)
fixFix race condition in CancellableRateLimitedFluxIterator #141323
feature[Axonius] Add manage, create_index, read, index, write, delete, permission for third party agent indices kibana_system #140046
featureUpgrade lz4 dependency to 1.10.1 #139221
featureUpgrade Netty to 4.1.130.Final #139669
fixBug fix: the filter of a data stream alias is not always properly removed #139679
fixMaking sure that failure store document converter does not hang on unexpected exceptions #139712 (issue: #139707)
fixESQL: Fix multi-value constant propagation after STATS #139442 (issue: #135926)
fixESQL: Prevent circular alias references in DeduplicateAggs #139175 (issues: #138346, #139541)
fixFix ABSENT/PRESENT on agg with false filter #139609
fixFix ST_DISTANCE handling of invalid geometry literals that fold to null #140116 (issue: #138594)
fix[Inference API] Fix auth exception listener not called bug #139966
fixSkip frozen nodes on disk watermark check #140118
fixEnsure initial state discovery does not block indefinitely on startup #139467
fixReject updating low-priority model deployments to more than 1 allocation #139989 (issue: #111227)
fixFix: IPv6 address parsing with non-zero offset in InetAddresses #139460
fixRevert "Attempt to clean up index before remote transfer" #139569
fixRegister disable_chunked_encoding S3 repo setting #139788
fixReduce task match load #139857 (issue: #139252)
securityFixes CVE-2025-68384: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial o…
featureBump lz4 dependency #138806
featureUpgrade ECS logging layout #138854
featureUpgrading tika to 3.2.3 #139267
featureImprove security migration resilience by handling version conflicts #137558
featureAdd node scoped vectors.indexing.use_gpu setting #138738
fixImproving performance of get data streams API by avoiding getting effective mappings #138948
fixFix downsampling with disabled subobjects #138715
fixFix multi fields in downsampling #138869
fixDo not pack non-dimension fields in TS #138929
fixFix columns ordering when pruning an INLINE STATS #136827 (issue: #136797)
fixFix enrich and lookup join resolution based on min transport version #137431
fixFixes esql class cast bug in STATS at planning level #137511 (issues: #133992, #136598)
fix[ES|QL] Compare query builders using identity #139080
fix[Inference API] Use dimensions field in JinaAI text_embedding requests #139413
fixGET /_migration/deprecations doesn't check disk watermarks against correct settings values #138115 (issue: #137005)
fixCorrectly handle empty inputs in chunkedInfer() #138632
fixFix offset maths bug in InetAddress parsing #139420
fixAdded logic for individual shard failure handling for CompoundRetrieverBuilder and fixed how partial search results flag is passed through to CompoundRetrieverBuilder #136732
fixSpeed up LeafCollector#setScorer in TopHitsAggregator #138883
fixMore reliable trigger for security index migration #139028
fixImproving performance of stats APIs when the number of shards is very large #138126 (issue: #97222)
fixDisallow index types updates to bbq_disk, revert #139061
securityFixes CVE-2025-37731: Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate s…
securityFixes CVE-2025-68390: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory…
feature[IRONSCALES] Add manage, create_index, read, index, write, delete, permission for third party agent indices kibana_system #138094 (issue: #138093)
featureDo not calculate query plan diff when not needed #137721
featureUpgrade UnboundID LDAP SDK to 7.0.3 #138053
featureUpgrading commons-lang3 version for repository-hdfs plugin #138589
featureUse IVF_PQ for GPU index build for large datasets #137126
fixBreak on FieldData when building global ordinals #108875 (issue: #97075)
fixFixing get data stream API when data stream index mode has been changed to time_series #137852
fixPrevent passing a pipeline to a logs stream bulk index request body #137992
fixFix: Downsample returns appropriate error when target index gets deleted unexpectedly. #138228
fixES|QL - Full text functions accept null as field parameter #137430 (issue: #136608)
fixFix StringIndexOutOfBoundsException in COMPLETION command when options are omitted. #138363 (issue: #138361)
fixFix integer overflow in block memory estimation #138132
fixHandle index deletion while querying in ES|QL #137702 (issue: #135863)
fixHandle serialization of null blocks in AggregateMetricDoubleBlock #138539
fixILM Explain: valid JSON on truncated step info #137638 (issue: #135458)
fixServerless filtering create from #137850
fixFix for GET /_migration/deprecations doesn't check deprecated affix settings correctly #137976 (issue: #137008)
fixFix for GET /_migration/deprecations doesn't report node deprecations if low watermark exceeded and GET /_migration/deprecations doesn't report node-level failures properly #137964 (issues: #137010, #137004)
fixFix default value for some settings when filtered #137652 (issue: #136333)
fixRestore API: Fix file settings handling #137585 (issue: #122429)
fixChange DatabaseNodeService error logs to warnings #138438
fixHandle individual doc parsing failure in bulk request with pipeline #138624 (issue: #138445)
fixImprove concurrency design of GeoIpDownloader #137660 (issues: #135158, #130681, #135132, #133597)
fixAdd validation for updating num_threads #138122 (issue: #137129)
fixBump anomalies index template version to install latest #138097
fixFix ML calendar event update scalability issues #136886
fixFix parsing of Google Model Garden Anthropic message_start event during chat_completion operation #137926
fixFix index.mapping.pattern_text.disable_templating not registered issue #138265
fixReject mappings that (eventually) set dimension and metric in the same field #138308
fixConvert BytesTransportResponse when proxying response from/to local node #135873
fixFix semantic highlighting when using a knn query with minimum similarity and when using bbq_disk #138140
fixFix Bug in RankDocRetrieverBuilder when from is set to Default (-1) #137637
fixFix: add missing vector_similarity_support in InferenceFeatures #138644
fixHandle Query Timeouts During Collector Initialization in QueryPhase #138084
fix[LTR] Fix feature display order when using explain #137671
fixPrincipal Extraction from Certificate RDN Attribute Value in PKI Realm #137230
fixAdd length validation for rename_replacement parameter in snapshot restore request #137859
fixOTLP: return correct response type for partial successes #137718
+3 more items in the release notesfeature[Sentinel One] Add manage, create_index, read, index, write, delete, permission for third-party agent indices in the Kibana system to support the threat event data stream. #137222 (issue: #240901)
featureEnable new data types with created version #136327
featureAllow opting out of force-merging on a cloned index in ILM's searchable snapshot action #137375
featureUpgrade ASM to 9.9 #136963
featureError if installed plugin is inside plugins folder #137398 (issue: #27401)
featureUpdate bundled JDK to Java 25.0.1+8 #137640
featureAdjust GPU graph building params #137074
fixReject invalid reverse_nested aggs #137047
fixAllow allocating clones over low watermark #137399
fixHandle indices with zero/missing uptime correctly in write-load calculation #136929
fixGrants kibana_system the ability to forcemerge certain indices #135795
fixHandle ._original stored fields with fls #137442
fixTaking additional settings providers into account for data stream effective settings #137407 (issue: #137381)
fixESQL: Fix double release in inline stats when LocalRelation is reused #136467 (issue: #135679)
fixESQL: Fix lookup join filter pushdown to use semantic equality #136818 (issue: #136599)
fixExtends constant MVs handling with warnings to general binary comparisons #137387
fixFix ReplaceAliasingEvalWithProject in case of shadowing #137025 (issue: #137019)
fixFix handling equality with MV constants properly #137032 (issues: #136998, #136939)
fixMake equals include ids for Alias, TypedAttribute #132455 (issues: #131509, #132634)
fixReturn ConstNullBlock in FromAggMetricDouble #136773
fixReturn a better error message when Timestamp is renamed in TS queries #136231 (issue: #134994)
fixFix ignore_unmapped setting when using geo_shape query with a pre-indexed shape #136961 (issue: #136954)
fixRemove auto_expand_replicas setting during index clone in searchable_snapshot #137111
fixFix mapping conflicts in clone/split/shrink APIs #137096
fixReindex-from-remote: Fail on manual slicing param #137275 (issue: #136269)
fixStart readiness service after http is started #136729
fixFix illegal_access_exception: class com.maxmind.db.Decoder from ip_location processor #137479
fixImprove concurrency design of EnterpriseGeoIpDownloader #134223 (issue: #126124)
fixDo not create inference endpoint if ID is used in existing mappings #137055 (issue: #124272)
fixPerform query field validation for rerank task type #137219
fixFix dropped ignore above fields #137394 (issue: #137360)
fixFixed geo point block loader slowness #136147
fixCatch exceptions from mapperService in StoreRecovery.recoverFromLocalShards #137077
fixDisallow max_inner_product, swap dot_product for cosine for int8_hnsw GPU type #136881
fixMake MutableSearchResponse ref-counted to prevent use-after-close in async search #134359
fixRemove early phase failure in batched #136889 (issue: #134151)
fixEnable _otlp usage with create_doc, auto_configure privileges #137325
fixUse Suppliers To Get Inference Results In Semantic Queries #136720 (issue: #136621)
featurefaster and cheaper indexing than HNSW
featureBetter behavior in lower memory environments (degrades linearly, not exponentially)
featureIs near HNSW for QPS when the index is in memory
featureonly floating point values are allowed currently
featurequantization is only to a single bit, so not recommended for low dimensionality vectors
featureall other restrictions that exist for dense_vector fields still apply
featureEnable the lexing/grammar for INLINE STATS in non-snapshot builds.
featureEnable more tests with FORK and INLINE STATS
featureImproved performance for lexical, vector and primary-key searches
featureUse optimistic-with-checking KNN Query execution strategy in place of cross-thread global queue min-score checking. Improves performance and consistency.
featureBulk scoring added for floating point vectors in HNSW. Improving query latency and indexing throughput
featureMultiple improvements to HNSW graph traversal and storage
featureAdd second max queue latency stat to ClusterInfo #132675
featureAdd attribute count to SamlAttribute toString #131173
featureAllow configuring SAML private attributes #133154
featureCorrect slow log user for RCS 2.0 #130140
featureAdd DLS stats to _security/stats #135271
featureAdd hits and misses timing stats to DLS cache #133314
featureAdd new /_security/stats endpoint #134835
featureExpose existing DLS cache x-pack usage statistics #132845
featureLazy compute and cache grantsAll per privilege #136684
feature[Cyera] Add manage, create_index, read, index, write, delete, permission for third party agent indices kibana_system #134894 (issue: #134183)
feature[Security] Add entity store and asset criticality index privileges to built in Editor, Viewer and Kibana System roles #129662
featurePush down compute engine value loading of long based singleton numeric doc value to the es819 tsdb doc values codec. #132622
featurePush down loading of singleton dense double based field types to the … #133397
featureSkip iterating DISI when reading metric values #133365
featureDLM: Better max_age rollover for tiny retentions #134941 (issue: #130960)
featureES-11331 streams params restriction #132967
featureEnable Failure Store for new logs-- data streams #131261 (issue: #131105)
featureEnable failure store for newly created OTel data streams #131395
featureOnly Allow Enabling Streams If No Conflicting Indices Exist #132064
featureRestrict Indexing To Child Streams When Streams Is Enabled #132011
featureRun TransportClusterStateAction on local node #129872
feature[Downsampling++] Add time series telemetry in xpack usage #134214 (issue: #133953)
featureAccept unsigned longs on MAX and MIN aggregations #131694
featureAdd Dependency Checker for LogicalLocalPlanOptimizer #130409
featureAdd SET instruction #134029
featureAdd checks that optimizers do not modify the layout #130855 (issue: #125576)
featureAdd fast path for single value in VALUES aggregator #130510
featureAdd optimized path for intermediate values aggregator #131390
+241 more items in the release notesfeature[Axonius] Add manage, create_index, read, index, write, delete, permission for third party agent indices kibana_system #140046
featureUpgrade lz4 dependency to 1.10.1 #139221
featureUpgrade Netty to 4.1.130.Final #139669
fixBug fix: the filter of a data stream alias is not always properly removed #139679
fixMaking sure that failure store document converter does not hang on unexpected exceptions #139712 (issue: #139707)
fixESQL: Fix multi-value constant propagation after STATS #139442 (issue: #135926)
fix[Inference API] Fix auth exception listener not called bug #139966
fixSkip frozen nodes on disk watermark check #140118
fixEnsure initial state discovery does not block indefinitely on startup #139467
fixRevert "Attempt to clean up index before remote transfer" #139569
fixReduce task match load #139857 (issue: #139252)
securityFixes CVE-2025-68384: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial o…
featureBump lz4 dependency #138806
featureUpgrade ECS logging layout #138854
featureUpgrading tika to 3.2.3 #139267
featureImprove security migration resilience by handling version conflicts #137558
fixFix: Correctly pickup MRT value for msearch's search requests #138583
fixAvoid stack overflow in IndicesClusterStateService applyClusterState #132536
fixFix multi fields in downsampling #138869
fixFixes esql class cast bug in STATS at planning level #137511 (issues: #133992, #136598)
fix[ES|QL] Compare query builders using identity #139080
fix[Inference API] Use dimensions field in JinaAI text_embedding requests #139413
fixGET /_migration/deprecations doesn't check disk watermarks against correct settings values #138115 (issue: #137005)
fixHandle individual doc parsing failure in bulk request with pipeline #138624 (issue: #138445)
fixCorrectly handle empty inputs in chunkedInfer() #138632
fixAdded logic for individual shard failure handling for CompoundRetrieverBuilder and fixed how partial search results flag is passed through to CompoundRetrieverBuilder #136732
fixMore reliable trigger for security index migration #139028
fixImproving performance of stats APIs when the number of shards is very large #138126 (issue: #97222)
securityFixes CVE-2025-37731: Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate s…
securityFixes CVE-2025-68390: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory…
feature[IRONSCALES] Add manage, create_index, read, index, write, delete, permission for third party agent indices kibana_system #138094 (issue: #138093)
featureUpgrade UnboundID LDAP SDK to 7.0.3 #138053
featureUpgrading commons-lang3 version for repository-hdfs plugin #138589
fixBreak on FieldData when building global ordinals #108875 (issue: #97075)
fixFix: Downsample returns appropriate error when target index gets deleted unexpectedly. #138228
fixFix integer overflow in block memory estimation #138132
fixHandle index deletion while querying in ES|QL #137702 (issue: #135863)
fixILM Explain: valid JSON on truncated step info #137638 (issue: #135458)
fixServerless filtering create from #137850
fixFix for GET /_migration/deprecations doesn't check deprecated affix settings correctly #137976 (issue: #137008)
fixFix default value for some settings when filtered #137652 (issue: #136333)
fixRestore API: Fix file settings handling #137585 (issue: #122429)
fixImprove concurrency design of GeoIpDownloader #137660 (issues: #135158, #130681, #135132, #133597)
fixBump anomalies index template version to install latest #138097
fixFix ML calendar event update scalability issues #136886
fixReject mappings that (eventually) set dimension and metric in the same field #138308
fixConvert BytesTransportResponse when proxying response from/to local node #135873
fixFix semantic highlighting when using a knn query with minimum similarity #138140
fixFix Bug in RankDocRetrieverBuilder when from is set to Default (-1) #137637
fixHandle Query Timeouts During Collector Initialization in QueryPhase #138084
fixAdd User Profile Size Limit Enforced During Profile Updates #137712
fixPrincipal Extraction from Certificate RDN Attribute Value in PKI Realm #137230
fixAdd length validation for rename_replacement parameter in snapshot restore request #137859
fix[Vector Search] Fix wrong vector docvalue_fields #137862
feature[Cyera] Add manage, create_index, read, index, write, delete, permission for third party agent indices kibana_system #134894 (issue: #134183)
feature[Sentinel One] Add manage, create_index, read, index, write, delete, permission for third-party agent indices in the Kibana system to support the threat event data stream. #137222 (issue: #240901)
featureUpgrade ASM to 9.9 #136963
featureError if installed plugin is inside plugins folder #137398 (issue: #27401)
featureUpdate bundled JDK to Java 25.0.1+8 #137640
fixGrants kibana_system the ability to forcemerge certain indices #135795
fixHandle ._original stored fields with fls #137442
fixFix ReplaceAliasingEvalWithProject in case of shadowing #137025 (issue: #137019)
fixFix ignore_unmapped setting when using geo_shape query with a pre-indexed shape #136961 (issue: #136954)
fixReindex-from-remote: Fail on manual slicing param #137275 (issue: #136269)
fixStart readiness service after http is started #136729
fixImprove concurrency design of EnterpriseGeoIpDownloader #134223 (issue: #126124)
fixDo not create inference endpoint if ID is used in existing mappings #137055 (issue: #124272)
fixPerform query field validation for rerank task type #137219
fixFix dropped ignore above fields #137394 (issue: #137360)
fixFixed geo point block loader slowness #136147
fixCatch exceptions from mapperService in StoreRecovery.recoverFromLocalShards #137077
fixMake MutableSearchResponse ref-counted to prevent use-after-close in async search #134359
fixRemove early phase failure in batched #136889 (issue: #134151)
fix[LTR] Fix feature display order when using explain #137671
featureLazy compute and cache grantsAll per privilege #136684
featureUse java8 variant of apm-agent #132651
fixDrop project-id from threadcontext for CCS #136664
fixMake ResolveUnionTypes rule stateless #136492
fixReindex-from-remote: Validate basic auth params #136501 (issue: #135925)
fixFix logsdb settings provider mapping filters #136119 (issue: #136107)
fixAdjust jinaai rerank response parser to handle document field as string or object #136751
fixClean up inference indices on failed endpoint creation #136577 (issue: #123726)
fixCohere service Model Id field is required #136017
fixEnsure queued AbstractRunnables are notified when executor stops #135966 (issue: #134651)
fixRelease cluster state #136769 (issue: #123243)
fixStore full path in _ignored when ignoring dynamic array field #136315
fixInitialize TermsEnum eagerly #136279
fixConfigurable HTTP read and connect timeouts for url based SAML metadata resolution #136058
fixOptimize Index Permission Automatons for Has Privileges #136625
fixAllow dynamic updates to frequency #136757 (issue: #133321)
fixCardinality Aggregator Throws UnsupportedOperationException When Field Type is Vector #135994
securityFixes CVE-2025-37727: Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/do…
featureChange reindex to use <>es-redacted filtering #135414
feature[Island Browser] Add manage, create_index, read, index, write, delete, permission for third party agent indices kibana_system #134636 (issue: #134136)
fixPropagates filter() to aggregation functions' surrogates #134461 (issue: #134380)
fixAddress es819 tsdb doc values format performance bug #135505 (issue: #135340)
fixBan Limit + MvExpand before remote Enrich #135051
fixFix async get results with inconsistent headers #135078 (issue: #135042)
fixFix expiration time in ES|QL async #135209 (issue: #135169)
fixBypass MMap arena grouping as this has caused issues with too many regions being mapped #135012
fixFix deadlock in ThreadPoolMergeScheduler when a failing merge closes the IndexWriter #134656
fixCentroidCalculator does not return negative summation weights #135176 (issue: #131861)
fixBug fix: Facilitate second retrieval of the same value #134790 (issue: #134770)
fixFix systemd notify to use a shared arena #135235
fixCorrectly apply field path to JSON processor when adding contents to document root #135479
fixAdd .reindexed-v7-ml-anomalies-* to anomaly results template index pattern #135270
fixGracefully shutdown model deployment when node is removed from assignment routing #134673
fixReset health status on successful empty checkpoint #135653 (issue: #135650)
fixTolerate mixed types in datafeed stats sort #135096
fixAvoid holding references to SearchExecutionContext in SourceConfirmedTextQuery #134887
fixFix for creating semantic_text fields on pre-8.11 indices crashing Elasticsearch #135845
fixFixed match only text block loader not working when a keyword multi field is present #134582
fixFix KQL case-sensitivity for keyword fields in ES|QL #135776 (issue: #135772)
fixFix a bug in the GET _transform API that incorrectly claims some Transform configurations are missing #134963 (issue: #134263)
fixPrevent Transform from queuing too many PIT close requests by waiting for PIT to close before finishing the checkpoint #134955 (issue: #134925)
feature[Sentinel One] Add manage, create_index, read, index, write, delete, permission for third party agent indices kibana_system #133793 (issue: #133703)
featureBump bc-fips to 1.0.2.6 #133198
featureAdd Reason field to elastic-agent upgrade details metadata #134711
featureUpgrade Netty to 4.1.126.Final #134182
featureBump bcpkix version #132853
fixAggs: Fix CB on reduction phase #133398
fixRemove DocumentSubsetBitsetCache locking #133681 (issue: #132842)
fixReserve memory for Lucene's TopN #134235
fixTrack memory in evaluators #133392
fixFix unnecessary determinization in index pattern conflict checks #134231 (issue: #133652)
fixRemove java.xml from system modules #133671
fixUpdate DefBootstrap to handle Error from ClassValue #133604
fixUse latest setting value when initializing setting watch #134091 (issue: #133701)
fixAvoid stale enrich results after policy execution #133752
fixFix allow_duplicates edge case bug in append processor #134319
fixFix enrich caches outdated value after policy run #133680
fixEnsuring only a single request executor object is created #133424
fixFix double-counting of inference memory in the assignment rebalancer #133919
fixAllow trailing empty string field names in paths of flattened field #133611 (issue: #130139)
fixFixed a bug where text fields in LogsDB indices did not use their keyword multi fields for block loading #134253
fixRemove Transfer-Encoding from HTTP request with no content #133775
fixDisallow creating semantic_text fields in indices created prior to 8.11.0 #133080
fixKQL: Support boolean operators in field queries #133737 (issue: #132366)
fixPrevent field caps from failing due to can match failure #134134 (issue: #116106)
fixUse inner query for equals/hashCode() in SourceConfirmedTextQuery #134451 (issue: #134432)
fixDelay S3 repo warning if default region absent #133848
featureLimit the depth of a filter #133113
featureUpgrading to tika 3.2.2 #133410
featureUpdate bundled JDK to Java 24.0.2+12 #133119
fixForce rollover on write to true when data stream indices list is empty #133347 (issue: #133176)
fixBetter error message for sequences with only one clause plus UNTIL #132638
fixFix sequences with conditions involving keys and non-keys #133134
fixFix update expiration for async query #133021 (issue: #130619)
fixChange GeoIpCache and EnrichCache to LongAdder #132922
fixLimit frequency of feature last-used time updates #133004
fixDisable child span for streaming tasks #132945
fixImprove EIS auth call logs and fix revocation bug #132546
fixPreserve lost thread context in node inference action. A lost context causes a memory leak if APM tracing is enabled #132973
fixUpdate EIS sparse and dense embedding max batch size to 16 #132646
fix[EIS] Rename the elser 2 default model and the default inference endpoint #130336
fixDon't fail search if bottom doc can't be formatted #133188 (issue: #125321)
feature[ExtraHop & QualysGAV] Add manage, create_index, read, index, write, delete, permission for third party agent indices kibana_system #132387 (issue: #131825)
fixData streams:
fixAuto-sharding for data streams caused unsupported replica scaling when the index mode was set to LOOKUP. This happened because lookup mappers do not support scaling beyond one replica. #131429 resolves this issue by disabling auto-sharding for data streams with LOOKUP index mode, avoiding…
fixEQL:
featureReduce NeighborArray on-heap memory during HNSW graph building
featureFix IndexSortSortedNumericDocValuesRangeQuery for integer sorting
featureValueSource.fromDoubleValuesSource(dvs).getSortField() would throw errors when used if the DoubleValuesSource needed scores
featurea bifurcation of the stream, with all data going to each fork branch, followed by
featurea merge of the branches, enhanced with a discriminator column called FORK:
featureAccumulate compute() calls and iterations between convergences #126008 (issue: #100850)
featureAdd FailedShardEntry info to shard-failed task source string #125520 (issue: #102606)
featureAdd cache support in TransportGetAllocationStatsAction #124898 (issue: #110716)
featureAdd cancellation support in TransportGetAllocationStatsAction #127371 (issue: #123248)
featureAllow balancing weights to be set per tier #126091
featureIntroduce AllocationBalancingRoundSummaryService #120957
featureMore efficient sort in tryRelocateShard #128063
featureSynonyms API - Add refresh parameter to check synonyms index and reload analyzers #126935 (issue: #121441)
featureAdd Support for Providing a custom ServiceAccountTokenStore through SecurityExtensions #126612
featureImplement SAML custom attributes support for Identity Provider #128176
featurePermit at+jwt typ header value in jwt access tokens #126687 (issue: #119370)
featureAdd Microsoft Graph Delegated Authorization Realm Plugin #127910
featureCheck TooComplex exception for HasPrivileges body #128870
featureDelegated authorization using Microsoft Graph (SDK) #128396
featureFix unsupported privileges error message during role and API key crea… #128858 (issue: #128132)
featureGranting kibana_system reserved role access to "all" privileges to .adhoc.alerts* and .internal.adhoc.alerts* indices #127321
feature[Security Solution] Add read index privileges to kibana_system role for Microsoft Defender integration indexes #126803
featureCheck if index patterns conform to valid format before validation #122497
featureAdd IndexingPressureMonitor to monitor large indexing operations #126372
featureEnhance memory accounting for document expansion and introduce max document size limit #123543
featureFirst step optimizing tsdb doc values codec merging #125403
featureUse default Lucene postings format when index mode is standard. #128509
featureAdd ability to redirect ingestion failures on data streams to a failure store #126973
featureAdd index mode to get data stream API #122486
featureRun TransportGetDataStreamLifecycleAction on local node #125214
featureRun TransportGetDataStreamOptionsAction on local node #125213
featureRun TransportGetDataStreamsAction on local node #122852
featureUpdate [email protected] with new GenAI fields #129122
feature[Failure store] Introduce dedicated failure store lifecycle configuration #127314
feature[Failure store] Introduce default retention for failure indices #127573
feature[apm-data] Enable 'date_detection' for all apm data streams #128913
featureAccount for time taken to write index buffers in IndexingMemoryController #126786
featureAdd MATCH_PHRASE #127661
featureAdd Support for LIKE (LIST) #129170
featureAdd documents_found and values_loaded #125631
+302 more items in the release notessecurityFixes CVE-2025-37727: Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/do…
featureChange reindex to use <>es-redacted filtering #135414
feature[Island Browser] Add manage, create_index, read, index, write, delete, permission for third party agent indices kibana_system #134636 (issue: #134136)
featureAdd Reason field to elastic-agent upgrade details metadata #134711
fixPropagates filter() to aggregation functions' surrogates #134461 (issue: #134380)
fixFix async get results with inconsistent headers #135078 (issue: #135042)
fixBypass MMap arena grouping as this has caused issues with too many regions being mapped #135012
fixFix deadlock in ThreadPoolMergeScheduler when a failing merge closes the IndexWriter #134656
fixCentroidCalculator does not return negative summation weights #135176 (issue: #131861)
fixFix systemd notify to use a shared arena #135235
fixCorrectly apply field path to JSON processor when adding contents to document root #135479
fixAdd .reindexed-v7-ml-anomalies-* to anomaly results template index pattern #135270
fixGracefully shutdown model deployment when node is removed from assignment routing #134673
fixReset health status on successful empty checkpoint #135653 (issue: #135650)
fixFix for creating semantic_text fields on pre-8.11 indices crashing Elasticsearch #135845
fixFix KQL case-sensitivity for keyword fields in ES|QL #135776 (issue: #135772)
fixPrevent field caps from failing due to can match failure #134134 (issue: #116106)
fixFix a bug in the GET _transform API that incorrectly claims some Transform configurations are missing #134963 (issue: #134263)
fixPrevent Transform from queuing too many PIT close requests by waiting for PIT to close before finishing the checkpoint #134955 (issue: #134925)