VersionDrift
Product

Elasticsearch 9.5.2 → 9.5.5

3 releases · 0 breaking changes · 15 security fixes · 15 advisories fixed

15security0breaking0deprecated23feature86fix

Is 9.5.2 affected?

Vulnerabilities fixed by this upgrade

  • 6.5 CVE-2026-103008 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with n…
  • 7.1 CVE-2026-103009 Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized s…
  • 6.5 CVE-2026-102411 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-s…
  • 6.5 CVE-2026-103005 Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges…
  • 7.2 CVE-2026-103007 Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticse…
  • 6.5 CVE-2026-102404 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted q…
  • 4.3 CVE-2026-102408 Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunk…
  • 6.5 CVE-2026-102409 Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (C…
  • 6.5 CVE-2026-94396 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
  • 6.5 CVE-2026-94397 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
  • 6.5 CVE-2026-94398 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
  • 6.5 CVE-2026-94399 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
  • 4.9 CVE-2026-94408 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
  • 6.5 CVE-2026-82294 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
  • 6.5 CVE-2026-82300 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).

Breaking changes

None in the release notes.

Security changes

  • security Fixes CVE-2026-103009: Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized s… in 9.5.5
  • security Fixes CVE-2026-103008: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with n… in 9.5.5
  • security Fixes CVE-2026-103005: Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges… in 9.5.5
  • security Fixes CVE-2026-102404: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted q… in 9.5.5
  • security Fixes CVE-2026-102409: Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (C… in 9.5.5
  • security Fixes CVE-2026-102408: Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunk… in 9.5.5
  • security Fixes CVE-2026-103007: Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticse… in 9.5.4
  • security Fixes CVE-2026-94396: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) in 9.5.4
  • security Fixes CVE-2026-94397: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) in 9.5.4
  • security Fixes CVE-2026-94398: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) in 9.5.4
  • security Fixes CVE-2026-94399: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) in 9.5.4
  • security Fixes CVE-2026-82300: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). in 9.5.4
  • security Fixes CVE-2026-102411: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-s… in 9.5.3
  • security Fixes CVE-2026-82294: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). in 9.5.3
  • security Fixes CVE-2026-94408: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) in 9.5.3

Every release in between

9.5.5 Oct 6, 2026 Release notes ↗
securityFixes CVE-2026-103009: Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized s…
securityFixes CVE-2026-103008: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with n…
securityFixes CVE-2026-103005: Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges…
securityFixes CVE-2026-102404: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted q…
securityFixes CVE-2026-102409: Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (C…
securityFixes CVE-2026-102408: Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunk…
featureLimit the multi_terms aggregation to a maximum of 128 fields #157906
featureAdd the manage, create_index, read, index, write, and delete privileges on third-party agent indices to the kibana_system role #160185
featureUpgrade the Parquet Hadoop bundle dependency #158981
featureUpgrade zstd-jni to 1.5.7-16 #159621
featurePass the reasoning effort setting through to OpenAI chat completion requests #156505
featureUpgrade Jackson to 2.21.7 #160501
featureUpgrade Netty to 4.1.138.Final #159561
fixFix replica divergence on indices that have sequence numbers disabled #158870 (issue: #150408)
fixPrevent the allocation explain API from starting gateway shard data fetches #157766 (issue: #155449)
fixAdd circuit breaker accounting to the Base64 functions, MV_CONCAT, and MV_ZIP #159659
fixClear Parquet and ORC filter state between query reuse cycles #158155
fixDisallow full text functions after UNION ALL when one of its branches contains a top N operation #158578
fixFix a ClassCastException in Parquet late-materialization filters when a predicate batch contains only null values #157587 (issue: #157313)
fixFix METADATA behavior with subqueries and logical views #157233 (issue: #160116)
fixFix a NullPointerException when folding a regular expression #158768 (issue: #158748)
fixFix TO_STRING being ignored in MATCH and MATCH_PHRASE on indexed fields #159416 (issue: #159395)
fixFix TO_TEXT being ignored in MATCH and MATCH_PHRASE on indexed fields #159269 (issue: #159265)
fixFix handling of the isPartial flag #157475 (issue: #157440)
fixFix an analyzer loop caused by repeated conversions #159257
fixFix nested fields conflicting with object fields #158573 (issue: #154011)
fixRead partition_detection and partition_path on the query path #157208
fixReject TRANGE queries that have a null start or offset #159125
fixReturn a warning instead of failing on cumulative T-Digests #160534
fixReturn a warning when a GROK typed conversion fails #160574 (issue: #160564)
fixHandle refresh exceptions in ensureShardSearchActive #159526
fixLimit the length of connector descriptions #159638
fixLimit geometry nesting depth when a geometry is constructed #160004
fixFix edge selection in the H3 great-circle latitude correction #160228 (issue: #159682)
fixConvert RecursiveChunker to an iterative implementation and cap the size of its separator list #158589
fixClear buffer files at startup #159701
fixAllow multipage PDFs in the semantic field #159641 (issue: #158773)
fixDetect level changes that coincide with the detection of new seasonality #3209 (issue: #2730)
fixStabilize uncertain trend forecasts #3189 (issue: #2772)
fixResolve high-cardinality keyword queries to ScanningBinaryDocValuesAutomatonQuery #158603 (issue: #158597)
+13 more items in the release notes
9.5.4 Sep 15, 2026 Release notes ↗
securityFixes CVE-2026-103007: Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticse…
securityFixes CVE-2026-94396: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
securityFixes CVE-2026-94397: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
securityFixes CVE-2026-94398: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
securityFixes CVE-2026-94399: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
securityFixes CVE-2026-82300: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
featureAdd manage, create_index, read, index, write, delete, permission for third party agent indices kibana_system #156029
featureUpgrade Jackson to 2.21.6 #157295 (issue: #141442)
featureAdd EuroBERT and Jina v5 ops to graph validation allowlist #3015
featureBetter error handling regarding quantiles state documents #2894
featureBetter handling of invalid JSON state documents #2895
featureBetter messaging regarding out of memory process termination #2841
featureDowngrade log severity for a batch of recoverable errors #2889
featureHarden pytorch_inference with TorchScript model graph validation #3008 (issue: #2890)
featureImprove adherence to memory limits for the bucket gatherer #2848
featureReport the actual memory usage of the autodetect process #2846
featureUpdate the PyTorch library to version 2.7.1 #2863
featureApply _msearch memory bounds, cancellation, and metrics to _msearch/template API #157642
featureImprove vector search calibration performance #153577
fixBound min_hash filter parameters to prevent out of memory errors #154480
fixCap min_hash filter parameters to a valid range #158211
fixReject allow_restricted_indices=true consistently in roles granted by users with the manage_roles privilege #158831
fixFix synthetic _id Terms#getMax crash during relocation id-lookup prewarm #158537
fixAdd doc-values fallback for unsigned_long queries #158545
fixFix incorrect results with COUNT(mv_field) on not indexed numeric or date fields #158381
fixReturn 400 for unresolved MMR query vector #158301 (issue: #157876)
fixWhen reversing strings, treat carriage return line feed (CRLF) as a single control character, in line with UTF guidelines #158745
fixFix null pointer exception in Amazon Bedrock chat completion when a message has no content #158527 (issue: #158521)
fixFail closed on incomplete TorchScript pre-load state-hook scan #3149
fixFail gracefully when restoring a categorizer with an out of range token ID #3143
fixFix flaky concurrent least frequently used (LFU) cache count invariant under lock timeouts #3090
fixHarden the Linux system call filter for machine learning native processes to block non-native instruction set variants #3080
fixMark machine learning controller non-dumpable before accepting commands #3081
fixPrevent anomaly detection job reopen from exhausting search scroll contexts during mass reassignment #154925 (issue: #153260)
fixReject TorchScript custom state hooks before load and forbid inductor::_reinterpret_tensor #3078
fixReturn HTTP 4xx status codes when machine learning nodes are exhausted #155310
fixFix LIKE/RLIKE list of patterns returning wrong results on non-indexed keyword fields and errors on wildcard fields #158228
fixFix missing counts in contains mapper query #158187
fixFix knn query pre-filtering for exists queries on inference fields #158296 (issue: #157951)
fixGuard against oversized protobuf requests causing out of memory failures #157968
+3 more items in the release notes
9.5.3 Sep 3, 2026 Release notes ↗
securityFixes CVE-2026-102411: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-s…
securityFixes CVE-2026-82294: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
securityFixes CVE-2026-94408: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
featureAdd request.raw_body to audit events for protobuf request bodies #158143
featureReject oversized request bodies when request-body auditing is enabled #157760
featureSpeed up vector quantization calibration during index merge #153577
fixLimit min_hash filter parameters to prevent integer overflow #158211
fixPrevent out-of-memory errors from extreme min_hash filter settings #154480
fixFix field-level security filtering for _field_names terms #157889
fixPrevent indexing-pressure rejections from stopping an entire bulk shard request #158235 (issue: #158212)
fixFix BYTE_LENGTH returning 0 for keyword fields in columnar mode #157858
fixFix incorrect MV_MIN and MV_PERCENTILE results in columnar mode #157857 (issue: #157817)
fixFix data stream auto-sharding using stale index settings #157634 (issue: #134505)
fixFix MV_MIN and MV_MAX on ip fields in columnar mode #157790 (issue: #157521)
fixFix ROUND overflowing integer values when used with negative precision #156412 (issue: #156411)
fixFix TS STATS dropping constant literal aggregates #157148 (issue: #157103)
fixFix failures in string functions that use extracted fields #156980
fixFix failures when reading _ignored_source out of document order #157798
fixFix query failures when a multi-field sub-field has conflicting types across indices #156326
fixFix translog resource leaks and leftover upload tasks on node shutdown #149429 (issue: #149343)
fixFix secret rotation in the inference _update API #157214
fixReject a blank datafeed ID in stop datafeed requests #157929
fixReject a blank job ID in close job requests #158020
fixReport skipped clusters in datafeed stats after a cross-cluster search failure #157567
fixFix composite aggregations returning no buckets on logsdb timestamp fields #158060 (issue: #158008)
fixFix contains queries failing on single-valued keyword fields #158187
fixFix search crashes from empty collect ranges in doc-values queries #157630
fixFail reindex tasks that cannot relocate during node shutdown #150342 (issues: #150294, #150295)
fixFix the SQL INSERT function ignoring the result size limit #157752
fixFix kNN automatic pre-filtering for exists queries on inference fields #158296 (issue: #157951)
fixSpeed up _shard_doc search_after pagination by applying sort pruning #157044 (issue: #155559)
fixFix leaking cancellation tasks in incremental bulk indexing #158108 (issue: #158018)
fixReduce memory usage when retrieving component and composable templates #158175
fixFix reading bfloat16 values from older index formats with different endianness #157730 (issue: #157696)
fixRestore early-exit scoring across segments for IVF search #157229
See how far your stack has drifted from upstream. Release data from vendors’ own sources · feed under CC BY 4.0 · Code under AGPL-3.0 Settings Feed status