Elasticsearch 9.2.7 → 9.4.2
13 releases · 0 breaking changes · 12 security fixes · 2 advisories fixed
12security0breaking0deprecated154feature237fix
Vulnerabilities fixed by this upgrade
- 4.9 CVE-2026-56143 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a sp…
- 6.5 CVE-2026-63136 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search…
Breaking changes
None in the release notes.
Security changes
- security Fixes CVE-2026-72683: A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation… in 9.3.8
- security Fixes CVE-2026-63263: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to… in 9.3.8
- security Fixes CVE-2026-63144: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index… in 9.3.8
- security Fixes CVE-2026-63140: Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query… in 9.3.8
- security Fixes CVE-2026-102407: Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user wi… in 9.3.8
- security Fixes CVE-2026-78607: Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges… in 9.3.8
- security Fixes CVE-2026-56145: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL s… in 9.3.7
- security Fixes CVE-2026-56144: Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By… in 9.3.7
- security Fixes CVE-2026-56148: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excess… in 9.3.6
- security Fixes CVE-2026-56149: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a sp… in 9.3.6
- security Fixes CVE-2026-63136: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search… in 9.3.4
- security Fixes CVE-2026-56143: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a sp… in 9.3.0
Every release in between
featureUpgrade to log4j 2.26.0 #132166 (issue: #132035)
featureAdd EuroBERT and Jina v5 ops to graph validation allowlist #3015
featureBetter error handling regarding quantiles state documents #2894
featureBetter handling of invalid JSON state documents #2895
featureBetter messaging regarding OOM process termination #2841
featureDowngrade log severity for a batch of recoverable errors #2889
featureHarden pytorch_inference with TorchScript model graph validation #3008 (issue: #2890)
featureImprove adherence to memory limits for the bucket gatherer #2848
featureReport the actual memory usage of the autodetect process #2846
featureRestrict file system access for pytorch models #2851
featureUpdate the PyTorch library to version 2.7.1 #2863
featureAdd logging tracking to _xpack/usage #148087
fixAggs: Account aggs uncompressed size on coordinator reduction #148885 (issue: #147190)
fixAggs: Fix auto_date_histogram/date_histogram inside a global agg #147427 (issue: #92570)
fixFix ArrayIndexOutOfBoundsException in date_histogram with hard_bounds outside data #148765 (issue: #148763)
fixFix CCR follow to handle indexing_complete race #145304
fixFix FsBlobContainer.moveBlobAtomic fallback on CIFS filesystems #148777 (issue: #148811)
fixDisallow casting to snapshot-only type #148813 (issue: #147867)
fixFix "optimized incorrectly" error from project reorder #149053 (issue: #148612)
fixFix ArrayIndexOutOfBoundsException in centroid grouping evaluateFinal #148815 (issue: #141318)
fixFix FROM *_logs index name validation #149395 (issue: #146073)
fixFix InvalidMappedField equals/hashCode and lazy error message #146117 (issue: #145907)
fixFix errors in blockloaders when filtering nulls on histograms #148983 (issue: #147854)
fixLucene TermsEnum and PostingsEnum may only be used from acquiring thread #149297
fixNode-reduce driver should not release search contexts on failure #145960 (issue: #145509)
fixNormalize _timeseries to JSON for stored source #148716 (issue: #148414)
fixUse search threadpool for coordination in ES|QL #149034
fixHonor task settings for Amazon Bedrock and Google Vertex chat completion #149268 (issue: #148792)
fix[Inference API] Fix NPE for Inference usage when referencing a embedding task type #149636
fix[Inference API] Fixing potential NPE if InferenceContext is null #148921
fix[Inference API] Use image/jpeg instead of image/jpg for inference validation MIME type #148793
fixPin server-launcher native -march to x86-64-v2 #148542 (issue: #148326)
fixUse toTruncatedString in chunked objects toString #147860 (issue: #143694)
fixMonitor exceptions in processing queries and log them as failures #148362
fixFix flaky CIoManagerTest/testFileIoGood test #3017
fixDefault PromQL index to metrics-* #148489
fixDefault Prometheus discovery APIs to metrics-* #148770
fixFix REPLACE with empty pattern #148616
fixDefault exclude_inference_fields to exclude_vectors at REST #148527 (issue: #146425)
fixFix UOE in CanMatch empty-shards skipped-by-cluster map #148754
+7 more items in the release notesfeatureAdd EuroBERT and Jina v5 ops to graph validation allowlist #3015
featureBetter error handling regarding quantiles state documents #2894
featureBetter handling of invalid JSON state documents #2895
featureBetter messaging regarding OOM process termination #2841
featureDowngrade log severity for a batch of recoverable errors #2889
featureHarden pytorch_inference with TorchScript model graph validation #3008 (issue: #2890)
featureImprove adherence to memory limits for the bucket gatherer #2848
featureReport the actual memory usage of the autodetect process #2846
featureRestrict file system access for pytorch models #2851
featureUpdate the PyTorch library to version 2.7.1 #2863
featureBump bundled JDK to Java 26.0.1 #147424
featureUpdate bundled JDK to Java 26 #146167
featureUpdate elastic-apm-agent-java8 to 1.55.6 #148271
fixUpdate failure store redirect logic to exclude backpressure exceptions #148154
fixBugfix - Block Loader Pushdown + Union Types #147940
fixDisallow empty lists in named params, only #147748 (issue: #147448)
fixES|QL query approximation: enforce minimum number of sampled source rows #147886
fixImplement RerankingInferenceService for Elastic service #148365
fix[Inference API] Fix inference initialization thread exhaustion #147063
fixFix flaky CIoManagerTest/testFileIoGood test #3017
fix[DiskBBQ] Check that precondition should not be overwritten on update #148111 (issue: #148004)
fixFix race in TickerScheduleTriggerEngine by checking watcher to node allocation #147678 (issue: #146874)
featureIt now provides 3x or more better search performance on very restrictive filters (prefilters on centroids)
featureProvides a way to condition non iid vectors (expert API for now)
featureGives more bit options (1, 2, 4, and 7 bits!)
featureMore native code improvements for overall performance
featureAccepts the standard Prometheus range query parameters (query, start, end, step, optional index)
featureTranslates the PromQL expression into an ES|QL PROMQL command and executes it via EsqlQueryAction
featureConverts the columnar ES|QL response into the Prometheus matrix JSON format and returns it to the caller
featureBump heap usage limits for INLINE STATS #144679
featureInject circuit breaker into forked SynonymMapBuilder #144800
featureSupport custom rulesets in analysis-icu/icu-transform plugin #143060
featureAdd Clone API Key endpoint #142633 (issue: #59304)
featureUpdate View CRUD Actions to be Index Actions #141570
feature[Entity Store] Add permissions for Entity Store datastream #145981
featureCPS and project routing support for templated searches #139446
featureDo not mark bulk indexing requests as retried after primary relocations #142157 (issue: #141586)
featureAdd dynamic bloom filter sizing based on document count #141342
featureAdd panama simd implementation of contains function for BinaryDocValuesContainsTermQuery #143922
featureAllow loading BYTE_LENGTH without decompressing Zstd byte ref blocks #141322
featureES819 Binary doc values: compact doc offsets using bit packing #142772
featureEnable large blocks for binary doc values by default. This mainly affects fields of type wildcard, ignored source, values hitting ignore above threshold and ignore malformed numbers and dates. #145216
featureFast codePointCount implementation for BytesRef #140388
featurePush contains binary doc values query down to es819 codec #143898
featureRewrite *substring* wildcard queries to contains term queries for binary doc values keywords #143433
featureTrack bloom filter disk usage in IndexDiskUsageAnalyzer #142106
featureUpgrade zstd to version 1.5.7 #140530
featureUse DirectAccessInput in ZstdDecompressor to avoid intermediate heap copy #145658
featureUse max instead of median for merged bloom filter size #143302
featureCodePointCount implementation using Panama vectors API #140693 (issue: #140567)
featureAdd 'logs.otel' and 'logs.ecs' stream types #141564 (issue: #141040)
featureEnsure DLM only runs one general loop at a time #143883
featureSupport Failure Stores in Cross Cluster Search #139316
featureBatch index creation #144074
featureBatch snapshot update tasks after external change #142091
featureEnsure that synthetic _id is usable after restarts/relocations #138678
featureHealth reports GREEN when provisionally unassigned replica #144773
featureIncrease the per-index limit for merges to half the CPUs #141389
featureOpt-in persistent task reassignment on node shutdown #143306
featureCollect dimensions only once per tsid when downsampling #145089
featureRate calculation for downsampled counters becomes aware of counter resets when the aggregate sampling method is used. #143381 (issue: #136178)
featureUse the tdigest type and compression from TDigest in downsampling #143247
+473 more items in the release notessecurityFixes CVE-2026-72683: A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation…
securityFixes CVE-2026-63263: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to…
securityFixes CVE-2026-63144: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index…
securityFixes CVE-2026-63140: Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query…
securityFixes CVE-2026-102407: Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user wi…
securityFixes CVE-2026-78607: Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges…
featureUpgrade OpenTelemetry in ms-graph-authz #151968
featureImplement watchdog timeout for GROK #152851
featureUpdate the commons-text library version to match commons.lang3 #152092
featureUpgrade Jackson #152163
featureBetter messaging regarding OOM process termination #2841
featureImprove adherence to memory limits for the bucket gatherer #2848
featureReport the actual memory usage of the autodetect process #2846
featureRestrict file system access for pytorch models #2851
featureUpdate the PyTorch library to version 2.7.1 #2863
fixAvoid out-of-memory errors by accounting for memory during the cardinality aggregation reduction phase #152773 (issue: #150290)
fixFix non-monotonic T-Digest centroids caused by floating-point errors #151979
fixFix null pointer exception when aggregation parameter scripts return null #152152 (issue: #136639)
fixFix data stream privilege checking #148179
fixImprove authorization for the simulate bulk action #152148
fixAvoid dense run-length allocation in HyperLogLog #152035
fixFix infinite loop in GeoLineDecomposer dateline crossing checks #152096 (issue: #152066)
fixTranslate tools and tool_choice to Anthropic format for Google Model Garden Anthropic chat completion #152427
fixInclude ingest metadata in self-reference checks #152932
fixAutomatically repair ML anomaly results aliases pointing at a .reindexed-v7 index #147688 (issue: #147686)
fixExtend the anomaly detection results template for reindexed indices and generalize healing beyond job_id mapping #153755 (issue: #147686)
fixFix ML jobs stuck in starting state on Serverless trial projects #150362
fixRoll reindexed ML state indices in daily maintenance #149555
fixAdd defensive protections when parsing query_string #152385
fixApply search timeout to the DFS phase query rewrite #153479
fixApply search timeout to the query rewrite step #153082 (issue: #104187)
fixFork ensureShardSearchActive callbacks off the refresh thread #152509 (issue: #97280)
fixReturn a 400 (Bad Request) for invalid tokens in a script query #152476
fixTrip request breaker on large completion suggest size/shardSize #152552
fixFix snapshot creation on CIFS shares when an access-denied exception occurs #153219 (issue: #152053)
fixIgnore OTLP number data points without a value #152733
fixTighten retry startup logic #152803
securityFixes CVE-2026-56145: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL s…
securityFixes CVE-2026-56144: Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By…
feature[Inference] Add requires org.apache.commons.lang3 to module-info #151794
featureBetter messaging regarding OOM process termination #2841
featureImprove adherence to memory limits for the bucket gatherer #2848
featureReport the actual memory usage of the autodetect process #2846
featureRestrict file system access for pytorch models #2851
featureUpdate the PyTorch library to version 2.7.1 #2863
fixResolve surrogates in union type field resolution before plan serialization #151633 (issue: #151475)
fixPass through includeSourceInError #142335
fixFix bug causing incorrect error on force deleting already deleted model #107188 (issue: #105420)
fixRevert "[ML] Add extra validation in trained_model creation" #152000
securityFixes CVE-2026-56148: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excess…
securityFixes CVE-2026-56149: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a sp…
featureUpdate the built-in kibana_system role to grant manage, create_index, read, index, write, and delete privileges on the axonius.alert_finding and axonius.incident indices, replacing the previous axonius.alert_and_incident index #149797
feature[otel-data] Explicitly map http.response.status_code as long #149631
featureUpgrade commons-lang3 version for the inference plugin #150242
featureBetter messaging regarding OOM process termination #2841
featureImprove adherence to memory limits for the bucket gatherer #2848
featureReport the actual memory usage of the autodetect process #2846
featureRestrict file system access for pytorch models #2851
featureUpdate the PyTorch library to version 2.7.1 #2863
featureUpgrade netty to 4.1.135.Final #151099
featureOptimize literal action automaton builds #151093 (issues: #123872, #105723)
fixFix Nynorsk stemmer UnsupportedOperationException. The light_nynorsk and minimal_nynorsk stemmers no longer fail with an HTTP 500 error during index creation due to passing an immutable map to Lucene's analysis factory. #150345
fixMove SAML metadata resolution to background thread #144381 (issue: #138031)
fixCatch StackOverflowError in deeply nested RLIKE patterns #150238 (issue: #149838)
fixEnforce limit for max nested functions #149971
fixFix wrong warning in expressions with unrolled multivalues #145968
fix[ESQL] Refactor Greatest and Least functions to use evaluator map #128429 (issue: #114036)
fixTruncate error for ILM's step_info instead of string #150413
fixValidate inference embedding model before checking for existing uses #150150 (issues: #147062, #150084)
fixWhen a streaming inference request is canceled, immediately release apache client networking resources #149987
fix[Inference API] Fix Streaming publisher shutdown race condition #150789 (issue: #150742)
fixDon't apply time zones to epoch-based timestamps #148663
fixFilter _source field names by code point #151146
fixFix OS stats for cgroup paths containing colons #151095
fixAdd extra validation in trained_model creation #150227
fixEQL/SQL: Enforce max expression depth checks #150003
fixAdd IT covering search during rolling restart #149667 (issue: #86927)
fixMake Automatons wildcard code-point aware #151143
fixFix OTLP histogram handling for single-count histograms without bucket boundaries #151411
fixHonor ClusterHealth timeout when waiting for transform internal index shards #149462 (issue: #149400)
featureUpgrade to log4j 2.26.0 #132166 (issue: #132035)
featureBetter messaging regarding OOM process termination #2841
featureImprove adherence to memory limits for the bucket gatherer #2848
featureReport the actual memory usage of the autodetect process #2846
featureRestrict file system access for pytorch models #2851
featureUpdate the PyTorch library to version 2.7.1 #2863
featureBump bundled JDK to Java 26.0.1 #147424
featureAdd logging tracking to _xpack/usage #148087
featureUpdate elastic-apm-agent-java8 to 1.55.6 #148271
fixAggs: Account aggs uncompressed size on coordinator reduction #148885 (issue: #147190)
fixAggs: Fix auto_date_histogram/date_histogram inside a global agg #147427 (issue: #92570)
fixFix ArrayIndexOutOfBoundsException in date_histogram with hard_bounds outside data #148765 (issue: #148763)
fixFix CCR follow to handle indexing_complete race #145304
fixUpdate failure store redirect logic to exclude backpressure exceptions #148154
fixFix FsBlobContainer.moveBlobAtomic fallback on CIFS filesystems #148777 (issue: #148811)
fixFix race in FsBlobContainer.moveBlobAtomic by replacing move op with hard link #147405 (issue: #147171)
fixFix management of PIT close failures after successful query #146634 (issues: #146263, #146187)
fixDisallow empty lists in named params, only #147748 (issue: #147448)
fixDo not enable doc-partitioning for count #143544 (issue: #134512)
fixFix ArrayIndexOutOfBoundsException in centroid grouping evaluateFinal #148815 (issue: #141318)
fixFix FROM *_logs index name validation #149395 (issue: #146073)
fixFix _index LIKE with ? wildcard #147462 (issue: #146364)
fixFix deriv aggregation function intermediate state #146160 (issue: #141305)
fixFix errors in blockloaders when filtering nulls on histograms #148983 (issue: #147854)
fixFix nullify under join and enrich #145743 (issue: #141827)
fixNode-reduce driver should not release search contexts on failure #145960 (issue: #145509)
fixNormalize _timeseries to JSON for stored source #148716 (issue: #148414)
fixReport correct location for SET errors #147582 (issue: #145873)
fixRestore TEXT field size estimate for Enrich and LookupJoin #147357
fixUse search threadpool for coordination in ES|QL #149034
fixHonor task settings for Amazon Bedrock and Google Vertex chat completion #149268 (issue: #148792)
fixImplement RerankingInferenceService for Elastic service #148365
fixMake similarity required for SageMaker ElasticTextEmbeddingPayload #146885
fix[Inference API] Fix inference initialization thread exhaustion #147063
fix[Inference API] Fixing potential NPE if InferenceContext is null #148921
fix[Inference API] Use image/jpeg instead of image/jpg for inference validation MIME type #148793
fixFix potential OOME on SearchResponse#toString() for extemely large responses #147267
fixUse toTruncatedString in chunked objects toString #147860 (issue: #143694)
fixPreserve zero-allocation trained-model deployments in cluster state during ML-node shutdown rebalances #146910 (issue: #146806)
fixFix REPLACE with empty pattern #148616
+13 more items in the release notessecurityFixes CVE-2026-63136: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search…
featureBump heap usage limits for INLINE STATS #144679
featureSkip time series field type merge for non-TS agg queries #143262
featureUpdate bundled JDK to Java 26 #146167
fixFix propagation of filters on join keys for missing events #145813 (issue: #145402)
fixDo not discard disjunction conditions when is null/is not null might invalidate them #145941
fixDon't use a Literal for constant_keyword fields when used inside full-text functions #145632 (issue: #145570)
fixESQL - Fix performance loading source when vectors are excluded #146223 (issue: #145799)
fixFix handling of values on the time bucket boundaries for ES|QL increase #145794
fixFix nested fields loading under NULLIFY #145741 (issue: #142616)
fixFix rate/increase single-value bucket handling for delta temporality #146518
fixFix starts_with/ends_with with special chars #146348 (issue: #130851)
fixKeywords mv count fix #145390
fixThrow a 400 error for malformed parsing input when missing element end #145777
fixFix pipeline resolution cache for bulk requests #144648
fixFix waiting for enrich policy execution for users without the monitor privilege #145751
fixOmit uncomputed model stats #146186
fixFix match only text decoding surrogate pairs #146567 (issue: #146538)
fixRestore initial thread context during reindex etc #146134
fixAdd cancellation support to IndicesRequestCache #141708
fixCollapse pathological regex quantifier stacking to prevent NFA construction OOM #145452
fixFix terminate_after not honored for aggs when size=0 #146199 (issue: #126665)
fixFix bug parsing "request" parameter in clear cache API, it should clear the request cache only #145726
fixUse query circuit breaker for wildcard/regexp determinization #145427 (issue: #145128)
fixUse IllegalArgumentException over RepositoryException for readonly-repository checks #140200
fixReplace IllegalStateException with IllegalArgumentException for conflicting time series metadata #142370
fixFix NPE in GPU resource pool when CuVSResources creation fails #146632
fixFix NPE when having double nested field with knn query #146933 (issue: #141830)
fix[DiskBBQ] Fix offHeap size for empty indices #146347
fix[DiskBBQ] Wait for queue saturation in MaxScoreTopKnnCollector #145341
featureSkip automaton construction for literal resource strings in application privilege checks #144685
fixFix ArrayIndexOutOfBoundsException in cat nodes for partial load average arrays #144859
fixCCR follower index needs to copy transport version from CCR leader index #145035
fixCancel async query on expiry #143016 (issue: #142662)
fixDon't over-alloc when unpacking dimension values #144525
fixESQL: Fix incorrectly optimized fork with nullify unmapped_fields #143030 (issue: #142762)
fixESQL: Fix null comparison type checking #140660 (issue: #140460)
fixFix field caps incorrectly synthesizing object parents under subobjects:false passthrough mappers #144183 (issue: #144179)
fixReduce LuceneOperator.Status memory consumption with large QueryDSL queries #143175 (issue: #143164)
fixFix createLDAPCertStore failing in FIPS mode #144453 (issues: #144376, #144377)
fixFix geo_centroid over geo_shape merging multiple shards #144637 (issue: #144504)
fixFix system index mapping update for reindexed indices after migration #144782 (issue: #144764)
fixFix "reset anomaly detection API" crashing when only colliding indices exist #144545 (issue: #144544)
fixLazily create matcher in BinaryDvConfirmedQuery #144698
fixFix ArrayIndexOutOfBoundsException in fetch phase with partial results #144385 (issue: #140495)
fixFix circuit breaker leak in percolator query construction #144827
fixFix request cache invalidation to use ES cache helper consistently #144581
fixFix wrong return value in ContextIndexSearcher.totalTermFreq #144333
fixFix up exception messages in AzureBlobStore #144654
fixFix dense_vector default index options when using BFLOAT16 #145202 (issue: #145204)
fix[DiskBBQ] Fix index sorting on flush #144938
fix[DiskBBQ] Fix index sorting on flush (2nd attempt) #145076
featureBump Kiota Libs #143556
feature[JupiterOne] Add manage, create_index, read, index, write, delete, permission for third party agent indices kibana_system #140049
feature[Sentinel One] Add manage, create_index, read, index, write, delete, permission for third-party agent indices in the Kibana system to support the unified alert data stream. #142648
featureApm-server: update monitor mappings to include new TBS metrics #140700
featureFix nested object float arrays being mapped to dense vectors when they are mapped in dynamic template mappings #143733 (issue: #143732)
featureSkip checkpoint query filter when runtime_mappings are present #142452
fixFix ClassCastException when merging TopHits with mixed sort field types #141919 (issue: #141714)
fixFix: _resolve/index API should be able to accept an empty body #143159
fixApm-data: explicit map of timestamp.us to long #143173
fixExpand DLM user to allow interaction with .workflows-events #143958
fixAccount for missing StubRelation due to SurrogateExpressions replacement #142882 (issue: #142219)
fixESQL - enable zero_terms_query option in MATCH function #143668 (issue: #143070)
fixFix KQL/QSTR with unmapped fields in NULLIFY mode #143399 (issues: #142968, #142959)
fixFix incorrect nullify with unmapped fields #142300 (issue: #141870)
fixFix nullify where in stats #144029 (issue: #143991)
fixFix unresolved name pattern #143210
fixPromptly clean up CCS exchange sinks #143325
fixSkip nullifying aliases for Aggregate groups. #141340
fixTS command ignores aliases in BY #143489
fixFix UnsupportedOperationException when using a plain highlighter with a query on a field used for index sorting (index.sort.*). #143680
fixFix Duplicate ML Model Allocations on Same Node #142872
fixFixed stats API to use correct allocation count for required_native_memory_bytes calculation #143077 (issue: #107831)
fixApply the source filter on metadata field mappers when loading from synthetic source #143726 (issue: #143464)
fixAdd circuit breaker for query construction to prevent OOM from automaton-based queries #142150
fixAdd timeout support for KNN searches in the DFS phase #142925
fixDisable CAE in microsoft-graph-authz plugin #142848 (issue: #142743)
fixFix use-after-free in SearchApplicationIndexService buffer lifecycle #143134
fixFix cancellation race in CancellableRateLimitedFluxIterator #141974
fix[ML]Fix latest transforms disregarding updates when sort and sync fields are non-monotonic #142856 (issue: #90643)
fixFix GPU merge ClassCastException with wrapped directories #143531
featureFix ILM's 'skipping policy' logging level #141890 (issue: #141876)
featureUpdating bundled jdk version to 25.0.2+10 #142500
fixDon't overwrite decision with NOT_PREFERRED unless its an improvement #141565
fixSuppress success callback when failing master task #142042
fixAllow include_source_on_error param on logs streams #141391 (issue: #141360)
fixAvoid a possible NPE by throwing an EIAE instead with more info #141711 (issue: #141267)
fixDeep copy BytesRef when creating a constant vector block #141242 (issues: #140615, #140809, #140621)
fixDynamically grow hash in linear counting in HLL #142047 (issue: #41847)
fixESQL fix TO_IP leading_zeros=octal parsing #141776 (issue: #141627)
fixFix IP_PREFIX function leaking data in scratch #141940 (issue: #141628)
fixFix NPE with null field parameter #142328 (issue: #142281)
fixFix TS bug when grouping on aliases #141568
fixFix bug with multiple spatial aggs filtering in ES|QL #142332 (issue: #142329)
fixFix injected attributes's IDs in UnionAll branches #141262
fixRemove incorrect inline stats pruning #141056 (issues: #140757, #139359)
fix[Inference API] Do not write "task" field in Jina embedding request if unsupported #142181
fix[Inference API] Fix ChunkingSettings field missing from ModelConfigurations equals method #142238
fix[Inference API] Prevent trailing slashes from being included in URLs #141692
fixReindexing older indices with percolator fields clears migration assistant errors #141539
fixFix cluster name in ECS upgrade #141792
fixEvict old models from the cache before loading new #140844
fixReduce locking when persisting ML job statistics #141519 (issue: #140511)
fixAllow shadowing time series metrics and dimension in non time series indexing #141549 (issue: #140882)
fixFixing for NPE when there is no query specified for the standard retriever #142479 (issue: #142336)
fixImplement comprehensive top N parameter handling for text similarity reranker #142039
fixFix QlIllegalArgumentException with non-foldable date range queries #142386 (issue: #137365)
fixEnsure Rewriteable.rewriteAndFetch listeners are not executed on transport threads #141904
fixFix Top Hits Incompatible Field Types on Sort Across Indices #142046 (issue: #141906)
fixFix handling empty collapse construct #141973 (issue: #139299)
fixPrevent large CancelTasksRequest descriptions by truncating nodes and actions #141815
fixReduce cancellation check interval in CancellableBulkScorer for better responsiveness #141747
fixFix built-in roles sync to retry on lock contention instead of silently discarding pending updates #142433
fixEnsure paused shard snapshot can be deleted #141408
fixTerminate GCS retries when node is shutting down #142193
fixTerminate S3 get blob retries when node is shutting down #142186
fixFix transform producing empty dest index when source query references runtime fields #142450 (issue: #113156)
fixFix transform validation to reject PUT and _start when user lacks remote index permissions #142403 (issue: #95367)
fix[GPU] Handle segments too big for MSAI segment access #141872 (issue: #141746)
securityFixes CVE-2026-56143: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a sp…
featureLet terms queries rewrite to a filter on constant_keyword fields #139106
featureAllocation: add balancer round summary as metrics #136043
featureAllocation: add duration and count metrics for write load hotspot #138465
featureIterate directly over contents of RoutingNode #137694
featureShard started reroute high priority #137306
featureSimulate shards moved by explicit commands #136066
featureTrack shardStarted events for simulation in DesiredBalanceComputer #135597
featureAdditional DEBUG logging on authc failures #137941
featureImprove SAML error handling by adding metadata #137598 (issue: #128179)
featureIn-response-to in saml successful response #137599 (issue: #128179)
feature[Axonius] Add manage, create_index, read, index, write, delete, permission for third party agent indices kibana_system #139345
feature[Security Solution] Add additional privileges to Kibana System role for .endpoint-scripts-file* indexes #139245
feature[Security Solution] Add privileges to Kibana System role for management of internal indexes in support of Elastic Defend features #138993
featureAdd support for project_routing for _search and _async_search #137566
featureCPS usage telemetry support #137705
featureCPS: Enable flatworld search and project_routing for _msearch #138822
featureDo not assume we hear back from all linked projects when validating resolved index expressions for CPS #137916
featureMRT should default to true for CPS searches #138105
featureAdd ThreadWatchdog to ClusterApplierService #134361
featureReport recent tasks updates when master starved #139518
featureEnable large numeric blocks for TSDB codec in production #139503
featureImproved bulk loading for binary doc values #138631
featureIntegrate stored fields format bloom filter with synthetic _id #138515
featureSimple bulk loading of compressed binary doc values #138541
featureAdding match_only_text subfield to *.display_name fields in ecs@mappings to be compliant with the latest additions in ECS #136265
featureSupport choosing the downsampling method in data stream lifecycle #137023
featureDisk usage don't include synthetic _id postings #138745
featureTransportGetBasicStatusAction runs on local #137567
featureAdd new sampling method to the Downsample API #136813
featureMove force merge from the downsampling request to the ILM action and allow users to disable it. #135834
featureAccept project_routing as query parameter #138559
featureEnable CPS #137833
featureAdd CHUNK function #134320
featureAdd MV_INTERSECTION Function #139379
featureAdd TOP_SNIPPETS function to return the best snippets for a field #138940
featureAdd TRANGE ES|QL function #136441 (issue: #135599)
featureAdd m alias for minute duration literal #136448 (issue: #135552)
featureAdd time_zone request param support to KQL and QSTR functions #138695
featureAdd optional parameters support to KQL function #135895 (issue: #135823)
+248 more items in the release notesfeatureImprove SAML error handling by adding metadata #137598 (issue: #128179)
featureIn-response-to in saml successful response #137599 (issue: #128179)
featureSkip automaton construction for literal resource strings in application privilege checks #144685
fixFix ArrayIndexOutOfBoundsException in cat nodes for partial load average arrays #144859
fixCCR follower index needs to copy transport version from CCR leader index #145035
fixCancel async query on expiry #143016 (issue: #142662)
fixReduce LuceneOperator.Status memory consumption with large QueryDSL queries #143175 (issue: #143164)
fixFix createLDAPCertStore failing in FIPS mode #144453 (issues: #144376, #144377)
fixFix geo_centroid over geo_shape merging multiple shards #144637 (issue: #144504)
fixFix system index mapping update for reindexed indices after migration #144782 (issue: #144764)
fixFix anomaly detection jobs stuck in opening by continously retrying to set the state to opened. #139668
fix[Inference API] Support chunking settings for sparse embeddings in custom service #138776
fixFix ArrayIndexOutOfBoundsException in fetch phase with partial results #144385 (issue: #140495)
fixFix circuit breaker leak in percolator query construction #144827
fixFix request cache invalidation to use ES cache helper consistently #144581
fixFix wrong return value in ContextIndexSearcher.totalTermFreq #144333
fixFix up exception messages in AzureBlobStore #144654
fix[DiskBBQ] Fix index sorting on flush #144938
fix[DiskBBQ] Fix index sorting on flush (2nd attempt) #145076
fixValidate Watcher Proxy Allowlist #144759