Is Elasticsearch 8.19.22 affected?

CVSS 7.1

5 known vulnerabilities affect 8.19.22 (highest CVSS 7.1).

1 newer release in its track, up to 8.19.23. What changed up to 8.19.23

A newer release line is out: 9.5.5.

Vulnerabilities affecting 8.19.22

7.1
CVE-2026-103009 Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized s… fixed in 8.19.23
6.5
CVE-2026-103008 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with n… fixed in 8.19.23
6.5
CVE-2026-102411 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-s… fixed in 8.19.23
6.5
CVE-2026-103005 Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges… fixed in 8.19.23
6.5
CVE-2026-102404 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted q… fixed in 8.19.23

Oct 6, 2026