DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Elasticsearch: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-08-13
Ein Angreifer kann mehrere Schwachstellen in Elasticsearch ausnutzen, um beliebigen Programmcode auszuführen, und um einen Denial of Service Angriff durchzuführen.
01
beschreibt (14)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-72687US | — | — | ||
A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes th… | ||||
| CVE-2026-72686US | — | — | ||
A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the… | ||||
| CVE-2026-72685US | — | — | ||
A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing on… | ||||
| CVE-2026-72684US | — | — | ||
A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input c… | ||||
| CVE-2026-72683US | — | — | ||
A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elasticsearch/op… | ||||
| CVE-2026-72679US | — | — | ||
Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded… | ||||
| CVE-2026-72678US | — | — | ||
Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user hold… | ||||
| CVE-2026-72656US | — | — | ||
Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenti… | ||||
| CVE-2026-72647US | — | — | ||
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only read privil… | ||||
| CVE-2026-72645US | — | — | ||
Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only read p… | ||||
| CVE-2026-72642US | — | — | ||
The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied i… | ||||
| CVE-2026-72639US | — | — | ||
Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against… | ||||
| CVE-2026-72638US | — | — | ||
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index cre… | ||||
| CVE-2026-72636US | — | — | ||
Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wil… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Elasticsearch Security Update vom 2026-08-13external
- Elasticsearch Security Update vom 2026-08-13external
- Elasticsearch Security Update vom 2026-08-13external
- Elasticsearch Security Update vom 2026-08-13external
- Elasticsearch Security Update vom 2026-08-13external
- Elasticsearch Security Update vom 2026-08-13external
- Elasticsearch Security Update vom 2026-08-13external
- Elasticsearch Security Update vom 2026-08-13external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan