バージョンを確認する
elasticsearch --version || curl -s localhost:9200影響を受けるバージョン系列
- 9.5 CVE 29 件
- 9.4 CVE 44 件
- 9.3 CVE 43 件 サポート終了（EOL）
- 9.2 CVE 44 件 サポート終了（EOL）
- 9.1 CVE 43 件 サポート終了（EOL）
- 9.0 CVE 42 件 サポート終了（EOL）
- 8.19 CVE 48 件
- 8.18 CVE 42 件 サポート終了（EOL）
- 8.17 CVE 42 件 サポート終了（EOL）
- 8.16 CVE 43 件 サポート終了（EOL）
- 8.15 CVE 44 件
- 8.14 CVE 45 件
- 8.13 CVE 48 件
- 8.12 CVE 49 件
- 8.11 CVE 47 件
- 8.10 CVE 47 件
- 8.9 CVE 46 件
- 8.8 CVE 47 件
- 8.4 CVE 47 件
- 8.2 CVE 47 件
- 8.0 CVE 46 件
- 7.17 CVE 20 件
- 7.16 CVE 16 件
- 7.14 CVE 16 件
- 7.13 CVE 20 件
- 7.11 CVE 21 件
- 7.10 CVE 19 件
- 7.9 CVE 20 件
- 7.7 CVE 21 件
- 7.6 CVE 22 件
- 7.3 CVE 22 件
- 7.2 CVE 23 件
- 7.0 CVE 23 件
- 6.8 CVE 14 件
- 6.7 CVE 14 件
- 6.6 CVE 12 件
- 6.5 CVE 13 件
- 6.4 CVE 14 件
- 6.2 CVE 14 件
- 6.0 CVE 14 件
- 5.6 CVE 13 件
- 5.0 CVE 12 件
- 3.6 CVE 11 件
- 2.13 CVE 11 件
- 1.6 CVE 13 件
- 1.5 CVE 15 件
- 1.4 CVE 15 件 KEV 1
- 1.3 CVE 16 件 KEV 1
- 1.2 CVE 16 件 KEV 1
既知の脆弱性
| CVE | タイトル | 影響を受けるバージョン | CVSS | 悪用 | EPSS | 公開日 |
|---|---|---|---|---|---|---|
| CVE-2015-1427 | The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to by... | < 1.3.8 ≥ 1.4.0 < 1.4.3 | 9.8 | KEV | 99.9% | 2015-02-18 |
| CVE-2014-3120 | The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers... | < 1.2.0 | 8.1 | KEV | 88.6% | 2014-07-29 |
| CVE-2026-115715 | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 ≤ 8.19.23 ≥ 9.0.0 ≤ 9.4.8 ≥ 9.5.0 ≤ 9.5.5 | 6.5 | — | 2026-11-04 | |
| CVE-2026-115710 | Use of Cache Containing Sensitive Information in Elasticsearch Leading to Information Disclosure | ≥ 8.9.0 ≤ 8.19.23 ≥ 9.0.0 ≤ 9.4.8 ≥ 9.5.0 ≤ 9.5.5 | 4.2 | — | 2026-11-04 | |
| CVE-2026-115298 | Incorrect Authorization in Elasticsearch Leading to Information Disclosure | ≥ 8.0.0 ≤ 8.19.23 ≥ 9.0.0 ≤ 9.4.8 ≥ 9.5.0 ≤ 9.5.5 | 4.3 | — | 2026-11-04 | |
| CVE-2026-115290 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | ≥ 8.10.0 ≤ 8.19.23 ≥ 9.0.0 ≤ 9.4.8 ≥ 9.5.0 ≤ 9.5.5 | 7.5 | — | 2026-11-04 | |
| CVE-2026-103009 | Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure | ≥ 8.13.0 < 8.19.23 ≥ 9.0.0 < 9.4.8 ≥ 9.5.0 < 9.5.5 | 7.1 | — | 2026-10-07 | |
| CVE-2026-103008 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | ≥ 8.12.0 < 8.19.23 ≥ 9.0.0 < 9.4.8 ≥ 9.5.0 < 9.5.5 | 6.5 | — | 2026-10-07 | |
| CVE-2026-103007 | Incorrect Authorization in Elasticsearch Leading to Privilege Escalation | ≥ 8.16.0 < 8.19.22 ≥ 9.0.0 < 9.4.7 ≥ 9.5.0 < 9.5.4 | 7.2 | — | 2026-10-07 | |
| CVE-2026-103006 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.21 ≥ 9.0.0 < 9.4.6 ≥ 9.5.0 < 9.5.2 | 6.5 | — | 2026-10-07 | |
| CVE-2026-103005 | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service | ≥ 8.12.0 < 8.19.23 ≥ 9.0.0 ≤ 9.3.8 ≥ 9.4.0 < 9.4.8 | 6.5 | — | 2026-10-07 | |
| CVE-2026-102411 | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.23 ≥ 9.0.0 < 9.4.7 ≥ 9.5.0 < 9.5.3 | 6.5 | — | 2026-10-07 | |
| CVE-2026-102409 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | ≥ 9.2.0 < 9.4.8 ≥ 9.5.0 < 9.5.5 ≥ 9.2.0 ≤ 9.2.8 | 6.5 | — | 2026-10-07 | |
| CVE-2026-102408 | Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service | ≥ 8.19.0 < 8.19.22 ≥ 9.1.0 < 9.4.8 ≥ 9.5.0 < 9.5.5 | 4.3 | — | 2026-10-07 | |
| CVE-2026-102407 | Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification | ≥ 7.17.5 ≤ 7.17.29 ≥ 8.2.2 < 8.19.19 ≥ 9.0.0 < 9.3.8 | 5.4 | — | 2026-10-07 | |
| CVE-2026-102404 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.23 ≥ 9.0.0 < 9.4.8 ≥ 9.5.0 < 9.5.5 | 6.5 | — | 2026-10-07 | |
| CVE-2026-94408 | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service | ≥ 8.0.0 < 8.19.22 ≥ 9.0.0 < 9.4.7 ≥ 9.5.0 < 9.5.3 | 4.9 | — | 2026-09-27 | |
| CVE-2026-94397 | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service | ≥ 8.0.0 < 8.19.22 ≥ 9.0.0 < 9.4.7 ≥ 9.5.0 < 9.5.4 | 6.5 | — | 2026-09-27 | |
| CVE-2026-94396 | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service | ≥ 9.2.0 < 9.4.7 ≥ 9.5.0 < 9.5.4 ≥ 9.2.0 ≤ 9.4.6 | 6.5 | — | 2026-09-27 | |
| CVE-2026-94399 | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service | ≥ 8.0.0 < 8.19.22 ≥ 9.0.0 < 9.4.7 ≥ 9.5.0 < 9.5.4 | 6.5 | — | 2026-09-27 | |
| CVE-2026-94398 | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service | ≥ 8.12.0 < 8.19.22 ≥ 9.0.0 < 9.4.7 ≥ 9.5.0 < 9.5.4 | 6.5 | — | 2026-09-27 | |
| CVE-2026-82300 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.22 ≥ 9.0.0 < 9.4.7 ≥ 9.5.0 < 9.5.4 | 6.5 | — | 2026-09-27 | |
| CVE-2026-82294 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.21 ≥ 9.0.0 < 9.4.6 ≥ 9.5.0 < 9.5.3 | 6.5 | — | 2026-09-27 | |
| CVE-2026-78607 | Missing Authorization in Elasticsearch Leading to Information Disclosure | ≥ 8.0.0 < 8.19.19 ≥ 9.0.0 < 9.3.8 ≥ 9.4.0 < 9.4.4 | 5.4 | — | 2026-09-02 | |
| CVE-2026-78605 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Informatio... | ≥ 8.18.0 < 8.19.20 ≥ 9.0.0 < 9.4.5 = 9.5.0 | 5.9 | — | 2026-09-02 | |
| CVE-2026-72649 | Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution | ≥ 8.0.0 < 8.19.20 ≥ 9.0.0 < 9.4.5 = 9.5.0 | 8.8 | — | 2026-09-02 | |
| CVE-2026-56143 | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.20 ≥ 9.0.0 < 9.3.0 ≥ 8.0.0 ≤ 8.19.19 | 4.9 | — | 2026-09-02 | |
| CVE-2026-72636 | Uncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of Service | ≥ 8.0.0 < 8.19.20 ≥ 9.0.0 < 9.4.5 ≥ 8.0.0 ≤ 8.19.19 | 6.5 | — | 2026-08-14 | |
| CVE-2026-72642 | Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process | ≥ 8.19.0 < 8.19.20 ≥ 9.4.0 < 9.4.5 ≥ 9.5.0 < 9.5.1 | 8.8 | — | 2026-08-14 | |
| CVE-2026-72639 | Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service | ≥ 8.19.0 < 8.19.20 ≥ 9.3.0 < 9.4.5 ≥ 9.5.0 < 9.5.1 | 6.5 | — | 2026-08-14 | |
| CVE-2026-72638 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.20 ≥ 9.0.0 < 9.4.5 ≥ 8.0.0 ≤ 8.19.19 | 6.5 | — | 2026-08-14 | |
| CVE-2026-72647 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.20 ≥ 9.0.0 < 9.4.5 ≥ 8.0.0 ≤ 8.19.19 | 6.5 | — | 2026-08-14 | |
| CVE-2026-72645 | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.20 ≥ 9.0.0 < 9.4.5 ≥ 9.5.0 < 9.5.1 | 6.5 | — | 2026-08-14 | |
| CVE-2026-72656 | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service | ≥ 8.11.0 < 8.18.0 ≥ 8.11.0 ≤ 8.17.9 | 6.5 | — | 2026-08-14 | |
| CVE-2026-72679 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | ≥ 8.19.0 < 8.19.20 ≥ 9.0.0 < 9.4.5 ≥ 8.19.0 ≤ 8.19.19 | 6.5 | — | 2026-08-14 | |
| CVE-2026-72678 | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service | ≥ 8.19.0 < 8.19.20 ≥ 9.4.0 < 9.4.5 ≥ 9.5.0 < 9.5.1 | 6.5 | — | 2026-08-14 | |
| CVE-2026-72687 | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.20 ≥ 9.0.0 < 9.4.5 ≥ 9.5.0 < 9.5.1 | 6.5 | — | 2026-08-14 | |
| CVE-2026-72686 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.20 ≥ 9.0.0 < 9.4.5 ≥ 9.5.0 < 9.5.1 | 6.5 | — | 2026-08-14 | |
| CVE-2026-72685 | Inefficient Algorithmic Complexity in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.20 ≥ 9.0.0 < 9.4.5 ≥ 8.0.0 ≤ 8.19.19 | 4.3 | — | 2026-08-14 | |
| CVE-2026-72684 | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.20 ≥ 9.0.0 < 9.4.5 ≥ 8.0.0 ≤ 8.19.19 | 6.5 | — | 2026-08-14 | |
| CVE-2026-72683 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | ≥ 5.0.0 < 8.19.19 ≥ 9.3.0 < 9.3.8 ≥ 9.4.0 < 9.4.4 | 6.5 | — | 2026-08-14 | |
| CVE-2026-63263 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.19 ≥ 9.0.0 < 9.3.8 ≥ 9.4.0 < 9.4.4 | 6.5 | — | 2026-07-22 | |
| CVE-2026-63144 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | ≥ 8.19.0 < 8.19.19 ≥ 9.3.0 < 9.3.8 ≥ 9.4.0 < 9.4.4 | 6.5 | — | 2026-07-22 | |
| CVE-2026-63140 | Reachable Assertion in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.19 ≥ 9.0.0 < 9.3.8 ≥ 9.4.0 < 9.4.4 | 6.5 | — | 2026-07-22 | |
| CVE-2026-63136 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.15 ≥ 9.0.0 < 9.2.9 ≥ 9.3.0 < 9.3.4 | 6.5 | — | 2026-07-22 | |
| CVE-2026-56145 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.18 ≥ 9.0.0 < 9.3.7 ≥ 9.4.0 < 9.4.4 | 6.5 | — | 2026-07-22 | |
| CVE-2026-56144 | Incorrect Authorization in Elasticsearch Leading to Information Disclosure | ≥ 8.12.0 < 8.19.18 ≥ 9.0.0 < 9.3.7 ≥ 9.4.0 < 9.4.4 | 5.3 | — | 2026-07-22 |
データ：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS については https://www.first.org/epss を参照）、endoflife.date。ソフトウェア一覧：awesome-selfhosted（CC BY-SA 3.0）。