Advisoriesby Ibis
Elasticsearch security advisories
43 advisories · none critical or high in 12 months · latest Dec 15, 2025
43 advisories
Elasticsearch: improper authenticationCVE-2025-37731fixed in 8.19.8 +2Elasticsearch: Insertion of Sensitive Information into Log File via reindex APICVE-2025-37727fixed in 8.18.8 +3Elasticsearch Uncontrolled Resource Consumption VulnerabilityCVE-2024-52979fixed in 7.17.25 +1Elasticsearch Vulnerable to Stack Overflow due to a Large RecursionCVE-2024-52981fixed in 7.17.24 +1Elasticsearch Potential Node Crash due to Large Recursion in `innerForbidCircularReferences` FunctionCVE-2024-52980fixed in 8.15.1Elasticsearch allocation of resources without limits or throttling leads to crashCVE-2024-43709fixed in 7.17.21 +1Elasticsearch Incorrect Authorization vulnerabilityCVE-2024-12539fixed in 8.16.2Elasticsearch stores private key on disk unencryptedCVE-2024-23444fixed in 7.17.23 +1Elasticsearch Insertion of Sensitive Information into Log FileCVE-2023-49921fixed in 7.17.16 +1Elasticsearch StackOverflow vulnerabilityCVE-2024-37280fixed in 8.14.0Elasticsearch Uncaught Exception leading to crashCVE-2024-23449fixed in 8.11.1Elasticsearch Incorrect Authorization vulnerabilityCVE-2024-23451fixed in 8.13.0Elasticsearch Uncontrolled Resource Consumption vulnerabilityCVE-2024-23450fixed in 7.17.19 +1Elasticsearch Improper Handling of Exceptional ConditionsCVE-2023-46673fixed in 7.17.14 +1Elasticsearch vulnerable to Uncontrolled Resource ConsumptionCVE-2023-31418fixed in 7.17.13 +1Elasticsearch allows insertion of sensitive information into log files when using deprecated URIsCVE-2023-31417fixed in 7.17.13 +1Elasticsearch vulnerable to stack overflow in the search APICVE-2023-31419fixed in 7.17.13 +1Improper Check for Unusual or Exceptional Conditions in ElasticsearchCVE-2022-23712fixed in 8.2.1Exposure of Sensitive Information to an Unauthorized Actor in ElasticsearchCVE-2021-22137fixed in 6.8.15 +1Insertion of Sensitive Information into Log File in ElasticsearchCVE-2020-7021fixed in 6.8.14 +1Improper privilege management in elasticsearchCVE-2020-7019fixed in 6.8.12 +1Improper Privilege Management in ElasticsearchCVE-2020-7009fixed in 6.8.8 +1Exposure of Sensitive Information to an Unauthorized Actor in ElasticsearchCVE-2019-7619fixed in 6.8.4 +1Concurrent Execution using Shared Resource with Improper Synchronization in ElasticsearchCVE-2019-7614fixed in 6.8.2 +1Improper Limitation of a Pathname to a Restricted Directory in ElasticsearchCVE-2015-3337fixed in 1.4.5 +1Elasticsearch Improper Access Control vulnerabilityCVE-2014-3120fixed in 1.4.0.Beta1Cross-site scripting in ElasticsearchCVE-2014-6439fixed in 1.4.0.Beta1Improper Access Control in ElasticsearchCVE-2015-1427fixed in 1.3.8 +1Improper Access Control in ElasticsearchCVE-2015-4165fixed in 1.6.0Improper Limitation of a Pathname to a Restricted Directory in ElasticsearchCVE-2015-5531fixed in 1.6.1Improper Restriction of XML External Entity Reference in ElasticsearchCVE-2018-17247fixed in 6.5.2Exposure of Sensitive Information to an Unauthorized Actor in ElasticsearchCVE-2018-17244fixed in 6.4.3Elasticsearch subject to cross site scriptingCVE-2018-3824fixed in 5.6.9 +1Exposure of Sensitive Information to an Unauthorized Actor in ElasticsearchCVE-2018-3831fixed in 5.6.12 +1Improper Access Control in ElasticsearchCVE-2019-7611fixed in 5.6.15 +1Elasticsearch privilege escalationCVE-2022-23708fixed in 7.17.1Exposure of sensitive information in ElasticsearchCVE-2021-22147fixed in 7.14.0Denial of Service in ElasticsearchCVE-2021-22144fixed in 6.8.17 +1API information disclosure flaw in ElasticsearchCVE-2021-22135fixed in 6.8.15 +1Insufficiently Protected Credentials in ElasticsearchCVE-2021-22132fixed in 7.10.2Privilege Escalation Flaw in ElasticsearchCVE-2020-7014fixed in 6.8.8 +1Privilege Context Switching Error in ElasticsearchCVE-2020-7020fixed in 6.8.13 +1Exposure of Sensitive Information to an Unauthorized ActorCVE-2021-22134fixed in 7.11.0About Elasticsearch
The search and analytics engine.
Packages watched: org.elasticsearch:elasticsearch (Maven).
Elastic elsewhere on Ibis: Acquisitions · Quarterly · Paydays · Releases · Repos · TechConf