Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.elasticsearch:elasticsearch

40 known vulnerabilities (1 critical, 2 high, 13 medium), with the versions each affects and the releases that fix them.

Latest release
9.5.6 (Nov 2, 2026): no advisory affects it
Newest unaffected release
9.5.6 (Nov 2, 2026), the latest release
Advisories
40 · 1 critical, 2 high, 13 medium
Dependents
10
Releases
500+ since 0.16.0 (Apr 23, 2011)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2024-52979
    Affects 0.16.0 to 7.17.24 (7.17.25 is outside it); 8.0.0-alpha1 to 8.15.5 (8.16.0 is outside it)
  • CVE-2024-52981
    Affects 7.17.0 to 7.17.23 (7.17.24 is outside it); 8.0.0-alpha1 to 8.15.0 (8.15.1 is outside it)
  • CVE-2024-43709
    Affects 0.16.0 to 7.17.20 (7.17.21 is outside it); 8.0.0 to 8.13.2 (8.13.3 is outside it)
  • CVE-2024-12539
    Affects 8.16.0 to 8.16.1 (8.16.2 is outside it)
  • CVE-2024-23444
    Affects 0.16.0 to 7.17.22 (7.17.23 is outside it); 8.0.0-alpha1 to 8.12.2 (8.13.0 is outside it)
  • CVE-2023-49921
    Affects 0.16.0 to 7.17.15 (7.17.16 is outside it); 8.0.0 to 8.11.1 (8.11.2 is outside it)
  • CVE-2024-37280
    Affects 8.13.1 to 8.13.4 (8.14.0 is outside it)
  • CVE-2024-23449
    Affects 8.4.0 to 8.11.0 (8.11.1 is outside it)
  • CVE-2024-23451
    Affects 8.10.0 to 8.12.2 (8.13.0 is outside it)
  • CVE-2024-23450
    Affects 7.0.0 to 7.17.18 (7.17.19 is outside it); 8.0.0 to 8.12.2 (8.13.0 is outside it)
  • CVE-2023-46673
    Affects 7.0.0 to 7.17.13 (7.17.14 is outside it); 8.0.0 to 8.10.2 (8.10.3 is outside it)
  • CVE-2023-31417
    Affects 7.0.0 to 7.17.12 (7.17.13 is outside it); 8.0.0 to 8.9.1 (8.9.2 is outside it)
Show all 40 advisoriesShow fewer advisories
  • CVE-2023-31418
    Affects 0.16.0 to 7.17.12 (7.17.13 is outside it); 8.0.0 to 8.8.2 (8.9.0 is outside it)
  • CVE-2023-31419
    Affects 7.0.0 to 7.17.12 (7.17.13 is outside it); 8.0.0 to 8.9.0 (8.9.1 is outside it)
  • CVE-2022-23712
    Affects 8.0.0 to 8.2.0 (8.2.1 is outside it)
  • CVE-2022-23708
    Affects 7.16.0 to 7.17.0 (7.17.1 is outside it)
  • CVE-2021-22147
    Affects 7.11.0 to 7.13.4 (7.14.0 is outside it)
  • CVE-2021-22144
    Affects 0.16.0 to 6.8.16 (6.8.17 is outside it); 7.0.0-alpha1 to 7.13.2 (7.13.3 is outside it)
  • CVE-2021-22137
    Affects 0.16.0 to 6.8.14 (6.8.15 is outside it); 7.11.0 to 7.11.1 (7.11.2 is outside it)
  • CVE-2021-22135
    Affects 0.16.0 to 6.8.14 (6.8.15 is outside it); 7.0.0 to 7.11.1 (7.11.2 is outside it)
  • CVE-2021-22134
    Affects 7.6.0 to 7.10.2 (7.11.0 is outside it)
  • CVE-2020-7021
    Affects 0.16.0 to 6.8.13 (6.8.14 is outside it); 7.0.0 to 7.9.3 (7.10.0 is outside it)
  • CVE-2021-22132
    Affects 7.7.0 to 7.10.1 (7.10.2 is outside it)
  • CVE-2020-7020
    Affects 0.16.0 to 6.8.12 (6.8.13 is outside it); 7.0.0 to 7.9.1 (7.9.2 is outside it)
  • CVE-2020-7019
    Affects 0.16.0 to 6.8.11 (6.8.12 is outside it); 7.0.0 to 7.8.1 (7.9.0 is outside it)
  • CVE-2020-7014
    Affects 6.7.0 to 6.8.7 (6.8.8 is outside it); 7.0.0 to 7.6.1 (7.6.2 is outside it)
  • CVE-2020-7009
    Affects 6.7.0 to 6.8.7 (6.8.8 is outside it); 7.0.0 to 7.6.1 (7.6.2 is outside it)
  • CVE-2019-7619
    Affects 6.7.0 to 6.8.3 (6.8.4 is outside it); 7.0.0 to 7.3.2 (7.4.0 is outside it)
  • CVE-2019-7614
    Affects 0.16.0 to 6.8.1 (6.8.2 is outside it); 7.0.0 to 7.2.0 (7.2.1 is outside it)
  • CVE-2019-7611
    Affects 0.16.0 to 5.6.14 (5.6.15 is outside it); 6.0.0 to 6.6.0 (6.6.1 is outside it)
  • CVE-2018-17247
    Affects 6.5.0 to 6.5.1 (6.5.2 is outside it)
  • CVE-2018-17244
    Affects 6.4.0 to 6.4.2 (6.4.3 is outside it)
  • CVE-2018-3831
    Affects 5.6.0 to 5.6.11 (5.6.12 is outside it); 6.0.0 to 6.4.0 (6.4.1 is outside it)
  • CVE-2018-3824
    Affects 0.16.0 to 5.6.8 (5.6.9 is outside it); 6.0.0 to 6.2.3 (6.2.4 is outside it)
  • CVE-2015-4165
    Affects 0.16.0 to 1.5.2 (1.6.0 is outside it)
  • CVE-2015-5531
    Affects 0.16.0 to 1.6.0 (1.6.1 is outside it)
  • CVE-2015-3337
    Affects 0.16.0 to 1.4.4 (1.4.5 is outside it); 1.5.0 to 1.5.1 (1.5.2 is outside it)
  • CVE-2015-1427
    Affects 0.16.0 to 1.3.7 (1.3.8 is outside it); 1.4.0 to 1.4.2 (1.4.3 is outside it)
  • CVE-2014-6439
    Affects 0.16.0 to 1.3.9 (1.4.0.Beta1 is outside it)
  • CVE-2014-3120
    Affects 0.16.0 to 1.3.9 (1.4.0.Beta1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 40

  • CVE-2024-52979Medium 6.5

    Elasticsearch Uncontrolled Resource Consumption vulnerability

    Affected: fixed in 7.17.25; from 8.0.0-alpha1, fixed in 8.16.0.

    Fixed in 7.17.25 (released Oct 21, 2024, 192 days before disclosure) and 8.16.0 (released Nov 12, 2024, 170 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • CVE-2024-52981Medium 4.9

    An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection…

    Affected: from 7.17.0, fixed in 7.17.24; from 8.0.0-alpha1, fixed in 8.15.1.

    Fixed in 7.17.24 (released Sep 9, 2024, 211 days before disclosure) and 8.15.1 (released Sep 3, 2024, 217 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • CVE-2024-43709Medium 6.5

    Elasticsearch allocation of resources without limits or throttling leads to crash

    Affected: fixed in 7.17.21; from 8.0.0, fixed in 8.13.3.

    Fixed in 7.17.21 (released Apr 30, 2024, 266 days before disclosure) and 8.13.3 (released Apr 30, 2024, 266 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • CVE-2024-12539Medium 6.0

    Elasticsearch Incorrect Authorization

    Affected: from 8.16.0, fixed in 8.16.2.

    Fixed in 8.16.2 (released Dec 12, 2024, 5 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • CVE-2024-23444Medium 4.9

    Elasticsearch elasticsearch-certutil csr fails to encrypt private key

    Affected: from 8.0.0-alpha1, fixed in 8.13.0; fixed in 7.17.23.

    Fixed in 7.17.23 (released Jul 30, 2024, 1 day before disclosure) and 8.13.0 (released Mar 26, 2024, 127 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • CVE-2023-49921Medium 5.2

    An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level.

    Affected: fixed in 7.17.16; from 8.0.0, fixed in 8.11.2.

    Fixed in 7.17.16 (released Dec 11, 2023, 228 days before disclosure) and 8.11.2 (released Dec 5, 2023, 234 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • CVE-2024-37280Medium 4.9

    Elasticsearch StackOverflow vulnerability

    Affected: from 8.13.1, fixed in 8.14.0.

    Fixed in 8.14.0 (released Jun 3, 2024, 10 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • CVE-2024-23449Medium 4.3

    Elasticsearch Uncaught Exception

    Affected: from 8.4.0, fixed in 8.11.1.

    Fixed in 8.11.1 (released Nov 11, 2023, 139 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • CVE-2024-23451Medium 4.4

    Elasticsearch Incorrect Authorization in the Remote Cluster Security API key based security model

    Affected: from 8.10.0, fixed in 8.13.0.

    Fixed in 8.13.0 (released Mar 26, 2024, 1 day before disclosure).

    The latest release, 9.5.6, is not affected.

  • CVE-2024-23450Medium 4.9

    Elasticsearch Uncontrolled Resource Consumption vulnerability

    Affected: from 7.0.0, fixed in 7.17.19; from 8.0.0, fixed in 8.13.0.

    Fixed in 7.17.19 (released Mar 25, 2024, 2 days before disclosure) and 8.13.0 (released Mar 26, 2024, 1 day before disclosure).

    The latest release, 9.5.6, is not affected.

  • CVE-2023-46673Medium 6.5

    It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash…

    Affected: from 7.0.0, fixed in 7.17.14; from 8.0.0, fixed in 8.10.3.

    Fixed in 7.17.14 (released Oct 8, 2023, 45 days before disclosure) and 8.10.3 (released Oct 8, 2023, 45 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • CVE-2023-31417Medium 4.1

    Elasticsearch Insertion of sensitive information in audit logs

    Affected: from 7.0.0, fixed in 7.17.13; from 8.0.0, fixed in 8.9.2.

    Fixed in 7.17.13 (released Sep 6, 2023, 50 days before disclosure) and 8.9.2 (released Sep 6, 2023, 50 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • Elasticsearch uncontrolled resource consumption

    Affected: fixed in 7.17.13; from 8.0.0, fixed in 8.9.0.

    Fixed in 7.17.13 (released Sep 6, 2023, 50 days before disclosure) and 8.9.0 (released Jul 24, 2023, 94 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • CVE-2023-31419Medium 6.5

    Elasticsearch StackOverflow vulnerability

    Affected: from 7.0.0, fixed in 7.17.13; from 8.0.0, fixed in 8.9.1.

    Fixed in 7.17.13 (released Sep 6, 2023, 50 days before disclosure) and 8.9.1 (released Aug 17, 2023, 70 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • A Denial of Service flaw was discovered in Elasticsearch.

    Affected: from 8.0.0, fixed in 8.2.1.

    Fixed in 8.2.1 (released May 24, 2022, 13 days before disclosure).

    The latest release, 9.5.6, is not affected.

Show all 40 advisoriesShow fewer advisories

  • A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built…

    Affected: from 7.16.0, fixed in 7.17.1.

    Fixed in 7.17.1 (released Feb 28, 2022, 3 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots.

    Affected: from 7.11.0, fixed in 7.14.0.

    Fixed in 7.14.0 (released Aug 3, 2021, 43 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack…

    Affected: fixed in 6.8.17; from 7.0.0-alpha1, fixed in 7.13.3.

    Fixed in 6.8.17 (released Jul 7, 2021, 19 days before disclosure) and 7.13.3 (released Jul 7, 2021, 19 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used.

    Affected: from 7.11.0, fixed in 7.11.2; fixed in 6.8.15.

    Fixed in 6.8.15 (released Mar 23, 2021, 51 days before disclosure) and 7.11.2 (released Mar 10, 2021, 64 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile…

    Affected: from 7.0.0, fixed in 7.11.2; fixed in 6.8.15.

    Fixed in 6.8.15 (released Mar 23, 2021, 51 days before disclosure) and 7.11.2 (released Mar 10, 2021, 64 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used.

    Affected: from 7.6.0, fixed in 7.11.0.

    Fixed in 7.11.0 (released Feb 10, 2021, 26 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option…

    Affected: fixed in 6.8.14; from 7.0.0, fixed in 7.10.0.

    Fixed in 6.8.14 (released Feb 10, 2021, the day of disclosure) and 7.10.0 (released Nov 11, 2020, 91 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API.

    Affected: from 7.7.0, fixed in 7.10.2.

    Fixed in 7.10.2 (released Jan 15, 2021, 1 day after disclosure).

    The latest release, 9.5.6, is not affected.

  • Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used.

    Affected: fixed in 6.8.13; from 7.0.0, fixed in 7.9.2.

    Fixed in 6.8.13 (released Oct 22, 2020, the day of disclosure) and 7.9.2 (released Sep 24, 2020, 28 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security.

    Affected: from 7.0.0, fixed in 7.9.0; fixed in 6.8.12.

    Fixed in 6.8.12 (released Aug 18, 2020, the day of disclosure) and 7.9.0 (released Aug 18, 2020, the day of disclosure).

    The latest release, 9.5.6, is not affected.

  • The fix for CVE-2020-7009 was found to be incomplete.

    Affected: from 6.7.0, fixed in 6.8.8; from 7.0.0, fixed in 7.6.2.

    Fixed in 6.8.8 (released Mar 30, 2020, 65 days before disclosure) and 7.6.2 (released Mar 30, 2020, 65 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create…

    Affected: from 6.7.0, fixed in 6.8.8; from 7.0.0, fixed in 7.6.2.

    Fixed in 6.8.8 (released Mar 30, 2020, 1 day before disclosure) and 7.6.2 (released Mar 30, 2020, 1 day before disclosure).

    The latest release, 9.5.6, is not affected.

  • Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service.

    Affected: from 6.7.0, fixed in 6.8.4; from 7.0.0, fixed in 7.4.0.

    Fixed in 6.8.4 (released Oct 22, 2019, 8 days before disclosure) and 7.4.0 (released Sep 27, 2019, 33 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request.

    Affected: fixed in 6.8.2; from 7.0.0, fixed in 7.2.1.

    Fixed in 6.8.2 (released Jul 24, 2019, 6 days before disclosure) and 7.2.1 (released Jul 24, 2019, 6 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are…

    Affected: fixed in 5.6.15; from 6.0.0, fixed in 6.6.1.

    Fixed in 5.6.15 (released Feb 13, 2019, 40 days before disclosure) and 6.6.1 (released Feb 13, 2019, 40 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API.

    Affected: from 6.5.0, fixed in 6.5.2.

    Fixed in 6.5.2 (released Nov 30, 2018, 20 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active…

    Affected: from 6.4.0, fixed in 6.4.3.

    Fixed in 6.4.3 (released Oct 31, 2018, 50 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured…

    Affected: from 5.6.0, fixed in 5.6.12; from 6.0.0, fixed in 6.4.1.

    Fixed in 5.6.12 (released Sep 18, 2018, 1 day before disclosure) and 6.4.1 (released Sep 13, 2018, 6 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability.

    Affected: fixed in 5.6.9; from 6.0.0, fixed in 6.2.4.

    Fixed in 5.6.9 (released Apr 12, 2018, 160 days before disclosure) and 6.2.4 (released Apr 12, 2018, 160 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code…

    Affected: fixed in 1.6.0.

    Fixed in 1.6.0 (released Jun 9, 2015, 792 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors…

    Affected: fixed in 1.6.1.

    Fixed in 1.6.1 (released Jul 16, 2015, 32 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote…

    Affected: fixed in 1.4.5; from 1.5.0, fixed in 1.5.2.

    Fixed in 1.4.5 (released Apr 27, 2015, 4 days before disclosure) and 1.5.2 (released Apr 27, 2015, 4 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • CVE-2015-1427Critical 9.8 · KEV

    The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection me

    Affected: fixed in 1.3.8; from 1.4.0, fixed in 1.4.3.

    Fixed in 1.3.8 (released Feb 11, 2015, 6 days before disclosure) and 1.4.3 (released Feb 11, 2015, 6 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • Cross-site scripting (XSS) vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject…

    Affected: fixed in 1.4.0.Beta1.

    Fixed in 1.4.0.Beta1 (released Oct 1, 2014, 9 days before disclosure).

    The latest release, 9.5.6, is not affected.

  • CVE-2014-3120High 8.1 · KEV

    The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL exp

    Affected: fixed in 1.4.0.Beta1.

    Fixed in 1.4.0.Beta1 (released Oct 1, 2014, 65 days after disclosure).

    The latest release, 9.5.6, is not affected.