WID-SEC-W-2026-2457

csafDEcert_bund

DeutschShown in its original language — a full translation is planned for a future version.

Elasticsearch: Mehrere Schwachstellen ermöglichen DoS und die Offenlegung von Informationen

view advisory published 2026-07-21

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Elasticsearch ausnutzen, um einen Denial of Service Angriff durchzuführen und vertrauliche Informationen offenzulegen.

01

describes (6)

Related CVEs.

IDseverity exploitable
CVE-2026-63263US——
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially…
CVE-2026-63144US——
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with…
CVE-2026-63140US——
Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in…
CVE-2026-63136US——
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a speciall…
CVE-2026-56145US——
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission…
CVE-2026-56144USmedium6.5OT elevated—
Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simula…
02

references

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan