Elasticsearch 9.5.4 → 9.5.6

2 releases · 0 breaking changes · 6 security fixes · 6 advisories fixed

6security0breaking0deprecated29feature51fix

Is 9.5.4 affected?

Vulnerabilities fixed by this upgrade

6.5 CVE-2026-103008 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with n…
7.1 CVE-2026-103009 Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized s…
6.5 CVE-2026-103005 Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges…
6.5 CVE-2026-102404 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted q…
4.3 CVE-2026-102408 Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunk…
6.5 CVE-2026-102409 Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (C…

Breaking changes

None in the release notes.

Security changes

security Fixes CVE-2026-103009: Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized s… in 9.5.5
security Fixes CVE-2026-103008: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with n… in 9.5.5
security Fixes CVE-2026-103005: Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges… in 9.5.5
security Fixes CVE-2026-102404: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted q… in 9.5.5
security Fixes CVE-2026-102409: Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (C… in 9.5.5
security Fixes CVE-2026-102408: Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunk… in 9.5.5

Every release in between

9.5.6 Nov 2, 2026 Release notes ↗

featureESQL:DS: Authorize datasets named by received compute plans #162687

featureBump bundled JDK to 27.0.1.0.2 #163046

featureBump bundled JDK to 27.0.1.0.3 #163627

featureUpgrade Jackson to 2.21.8 #163710

featureUpgrade to lucene 10.5.2 #161372

featureAdd EuroBERT and Jina v5 ops to graph validation allowlist #3015

featureBetter error handling regarding quantiles state documents #2894

featureBetter handling of invalid JSON state documents #2895

featureBetter messaging regarding OOM process termination #2841

featureDowngrade log severity for a batch of recoverable errors #2889

featureHarden pytorch_inference with TorchScript model graph validation #3008 (issue: #2890)

featureImprove adherence to memory limits for the bucket gatherer #2848

featureReport the actual memory usage of the autodetect process #2846

featureUpdate the PyTorch library to version 2.7.1 #2863

featureMake GCS Storage retry on SSL exception #161154

featureBump lz4 to 1.11.4 #161406

featureBump snappy-java to 1.1.10.11 #161310

featureUpdate jsoup to 1.23.2 #160619

featureUpgrade Bouncy Castle to 1.86 #161326

featureUpgrade bcutil-fips to 2.0.8 #162600

featureUpgrade reactor-core to 3.8.7 #160494

featureAdd legacy_content_md5 S3 client setting #162197

fixReject non-positive size in composite aggregation #163307 (issue: #163038)

fixFail AllocationActionListener delegate only once #162309 (issues: #160180, #152475)

fixBound heap/allocation growth in analysis-phonetic #159667

fixFix streamed requests with secondary authentication being dispatched off the network thread #162171

fixApply field visibility to constant_keyword #159351

fixFix count drift in multi-valued binary index sort at flush #162228

fixAvoid quadratic failed response size when failure store redirects fail #162017 (issue: #157859)

fixShow the effective index mode and settings of the next backing index in GET _data_stream, and honor settings that a request explicitly unsets. #161250 (issue: #125685)

fixTSDB: not all documents with invalid timestamps are redirected to the failure store #161117 (issue: #161001)

fixDon't return unassigned shards in primary shard routing iterator #160492

fixHandle IndexShardClosedException and shutdown in ReplicationOperation::updateCheckPoints #162378 (issue: #158303)

fixMake downsample resume from the last indexed tsid work #162669

fixAvoid nested listeners in doc-partitioning cache #158910

fixBind ES|QL lookup requests to their target shard #162521

fixCache output #161282

fixCatch REPLACE regex StackOverflowError #157957

fixCircuit-break before growing the array #160592

fixCount only distinct warnings towards the cap #161338 (issues: #161319, #148398)

+83 more items in the release notes

9.5.5 Oct 6, 2026 Release notes ↗

securityFixes CVE-2026-103009: Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized s…

securityFixes CVE-2026-103008: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with n…

securityFixes CVE-2026-103005: Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges…

securityFixes CVE-2026-102404: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted q…

securityFixes CVE-2026-102409: Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (C…

securityFixes CVE-2026-102408: Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunk…

featureLimit the multi_terms aggregation to a maximum of 128 fields #157906

featureAdd the manage, create_index, read, index, write, and delete privileges on third-party agent indices to the kibana_system role #160185

featureUpgrade the Parquet Hadoop bundle dependency #158981

featureUpgrade zstd-jni to 1.5.7-16 #159621

featurePass the reasoning effort setting through to OpenAI chat completion requests #156505

featureUpgrade Jackson to 2.21.7 #160501

featureUpgrade Netty to 4.1.138.Final #159561

fixFix replica divergence on indices that have sequence numbers disabled #158870 (issue: #150408)

fixPrevent the allocation explain API from starting gateway shard data fetches #157766 (issue: #155449)

fixAdd circuit breaker accounting to the Base64 functions, MV_CONCAT, and MV_ZIP #159659

fixClear Parquet and ORC filter state between query reuse cycles #158155

fixDisallow full text functions after UNION ALL when one of its branches contains a top N operation #158578

fixFix a ClassCastException in Parquet late-materialization filters when a predicate batch contains only null values #157587 (issue: #157313)

fixFix METADATA behavior with subqueries and logical views #157233 (issue: #160116)

fixFix a NullPointerException when folding a regular expression #158768 (issue: #158748)

fixFix TO_STRING being ignored in MATCH and MATCH_PHRASE on indexed fields #159416 (issue: #159395)

fixFix TO_TEXT being ignored in MATCH and MATCH_PHRASE on indexed fields #159269 (issue: #159265)

fixFix handling of the isPartial flag #157475 (issue: #157440)

fixFix an analyzer loop caused by repeated conversions #159257

fixFix nested fields conflicting with object fields #158573 (issue: #154011)

fixRead partition_detection and partition_path on the query path #157208

fixReject TRANGE queries that have a null start or offset #159125

fixReturn a warning instead of failing on cumulative T-Digests #160534

fixReturn a warning when a GROK typed conversion fails #160574 (issue: #160564)

fixHandle refresh exceptions in ensureShardSearchActive #159526

fixLimit the length of connector descriptions #159638

fixLimit geometry nesting depth when a geometry is constructed #160004

fixFix edge selection in the H3 great-circle latitude correction #160228 (issue: #159682)

fixConvert RecursiveChunker to an iterative implementation and cap the size of its separator list #158589

fixClear buffer files at startup #159701

fixAllow multipage PDFs in the semantic field #159641 (issue: #158773)

fixDetect level changes that coincide with the detection of new seasonality #3209 (issue: #2730)

fixStabilize uncertain trend forecasts #3189 (issue: #2772)

fixResolve high-cardinality keyword queries to ScanningBinaryDocValuesAutomatonQuery #158603 (issue: #158597)

+13 more items in the release notes