Elasticsearch 9.5.4 → 9.5.5

1 release · 0 breaking changes · 6 security fixes · 6 advisories fixed

6security0breaking0deprecated7feature33fix

Is 9.5.4 affected?

Vulnerabilities fixed by this upgrade

6.5 CVE-2026-103008 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with n…
7.1 CVE-2026-103009 Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized s…
6.5 CVE-2026-103005 Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges…
6.5 CVE-2026-102404 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted q…
4.3 CVE-2026-102408 Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunk…
6.5 CVE-2026-102409 Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (C…

Breaking changes

None in the release notes.

Security changes

security Fixes CVE-2026-103009: Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized s… in 9.5.5
security Fixes CVE-2026-103008: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with n… in 9.5.5
security Fixes CVE-2026-103005: Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges… in 9.5.5
security Fixes CVE-2026-102404: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted q… in 9.5.5
security Fixes CVE-2026-102409: Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (C… in 9.5.5
security Fixes CVE-2026-102408: Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunk… in 9.5.5

Every release in between

9.5.5 Oct 6, 2026 Release notes ↗

securityFixes CVE-2026-103009: Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized s…

securityFixes CVE-2026-103008: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with n…

securityFixes CVE-2026-103005: Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges…

securityFixes CVE-2026-102404: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted q…

securityFixes CVE-2026-102409: Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (C…

securityFixes CVE-2026-102408: Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunk…

featureLimit the multi_terms aggregation to a maximum of 128 fields #157906

featureAdd the manage, create_index, read, index, write, and delete privileges on third-party agent indices to the kibana_system role #160185

featureUpgrade the Parquet Hadoop bundle dependency #158981

featureUpgrade zstd-jni to 1.5.7-16 #159621

featurePass the reasoning effort setting through to OpenAI chat completion requests #156505

featureUpgrade Jackson to 2.21.7 #160501

featureUpgrade Netty to 4.1.138.Final #159561

fixFix replica divergence on indices that have sequence numbers disabled #158870 (issue: #150408)

fixPrevent the allocation explain API from starting gateway shard data fetches #157766 (issue: #155449)

fixAdd circuit breaker accounting to the Base64 functions, MV_CONCAT, and MV_ZIP #159659

fixClear Parquet and ORC filter state between query reuse cycles #158155

fixDisallow full text functions after UNION ALL when one of its branches contains a top N operation #158578

fixFix a ClassCastException in Parquet late-materialization filters when a predicate batch contains only null values #157587 (issue: #157313)

fixFix METADATA behavior with subqueries and logical views #157233 (issue: #160116)

fixFix a NullPointerException when folding a regular expression #158768 (issue: #158748)

fixFix TO_STRING being ignored in MATCH and MATCH_PHRASE on indexed fields #159416 (issue: #159395)

fixFix TO_TEXT being ignored in MATCH and MATCH_PHRASE on indexed fields #159269 (issue: #159265)

fixFix handling of the isPartial flag #157475 (issue: #157440)

fixFix an analyzer loop caused by repeated conversions #159257

fixFix nested fields conflicting with object fields #158573 (issue: #154011)

fixRead partition_detection and partition_path on the query path #157208

fixReject TRANGE queries that have a null start or offset #159125

fixReturn a warning instead of failing on cumulative T-Digests #160534

fixReturn a warning when a GROK typed conversion fails #160574 (issue: #160564)

fixHandle refresh exceptions in ensureShardSearchActive #159526

fixLimit the length of connector descriptions #159638

fixLimit geometry nesting depth when a geometry is constructed #160004

fixFix edge selection in the H3 great-circle latitude correction #160228 (issue: #159682)

fixConvert RecursiveChunker to an iterative implementation and cap the size of its separator list #158589

fixClear buffer files at startup #159701

fixAllow multipage PDFs in the semantic field #159641 (issue: #158773)

fixDetect level changes that coincide with the detection of new seasonality #3209 (issue: #2730)

fixStabilize uncertain trend forecasts #3189 (issue: #2772)

fixResolve high-cardinality keyword queries to ScanningBinaryDocValuesAutomatonQuery #158603 (issue: #158597)

+13 more items in the release notes