A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HElastic Elasticsearch
APPElastic8.0.0 – 8.2.1 (excl.)
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
Auth BypassDoS
Related vulnerabilities
CVE-2015-1427CRITICAL9.8⚠ KEVPL ✓same product
Elasticsearch: ucieczka z sandboksa Groovy i zdalne wykonanie poleceń
CVE-2015-5377CRITICAL9.8PL ✓same product
RCE w Elasticsearch przez protokół transportowy (przed wersją 1.6.1)
CVE-2014-3120HIGH8.1⚠ KEVsame product
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers...
CVE-2026-72649HIGH8.8same product
Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote...
CVE-2026-72642HIGH8.8same product
The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a mo...