Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Reachable Assertion in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Incorrect Authorization in Elasticsearch Leading to Information Disclosure

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Elasticsearch Allocation of Resources Without Limits or Throttling

A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elasticsearch node to…

Elasticsearch Incorrect Authorization

An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level

It was identified that if a cross-cluster API key…

Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elasticsearch 8.10.0 and before 8.13.0

Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots

In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok…

A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting

In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security

Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms

In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure

A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API

Elasticsearch Insertion of sensitive information in log file

Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification

An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API

In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used

Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security…

Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service

Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service

Elasticsearch Allocation of Resources Without Limits or Throttling

A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of “passthrough” type

Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled

Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API

Elasticsearch generally filters out sensitive information and credentials before logging to the audit log

Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service

Inefficient Algorithmic Complexity in Elasticsearch Leading to Denial of Service

A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index,…

A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used

Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls

Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via…

Cross-site scripting (XSS) vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject arbitrary web script or HTML via…