检查您的版本
elasticsearch --version || curl -s localhost:9200受影响的版本系列
- 9.5 29 个 CVE
- 9.4 44 个 CVE
- 9.3 43 个 CVE 生命周期结束
- 9.2 44 个 CVE 生命周期结束
- 9.1 43 个 CVE 生命周期结束
- 9.0 42 个 CVE 生命周期结束
- 8.19 48 个 CVE
- 8.18 42 个 CVE 生命周期结束
- 8.17 42 个 CVE 生命周期结束
- 8.16 43 个 CVE 生命周期结束
- 8.15 44 个 CVE
- 8.14 45 个 CVE
- 8.13 48 个 CVE
- 8.12 49 个 CVE
- 8.11 47 个 CVE
- 8.10 47 个 CVE
- 8.9 46 个 CVE
- 8.8 47 个 CVE
- 8.4 47 个 CVE
- 8.2 47 个 CVE
- 8.0 46 个 CVE
- 7.17 20 个 CVE
- 7.16 16 个 CVE
- 7.14 16 个 CVE
- 7.13 20 个 CVE
- 7.11 21 个 CVE
- 7.10 19 个 CVE
- 7.9 20 个 CVE
- 7.7 21 个 CVE
- 7.6 22 个 CVE
- 7.3 22 个 CVE
- 7.2 23 个 CVE
- 7.0 23 个 CVE
- 6.8 14 个 CVE
- 6.7 14 个 CVE
- 6.6 12 个 CVE
- 6.5 13 个 CVE
- 6.4 14 个 CVE
- 6.2 14 个 CVE
- 6.0 14 个 CVE
- 5.6 13 个 CVE
- 5.0 12 个 CVE
- 3.6 11 个 CVE
- 2.13 11 个 CVE
- 1.6 13 个 CVE
- 1.5 15 个 CVE
- 1.4 15 个 CVE KEV 1
- 1.3 16 个 CVE KEV 1
- 1.2 16 个 CVE KEV 1
已知漏洞
| CVE | 标题 | 受影响版本 | CVSS | 被利用 | EPSS | 发布日期 |
|---|---|---|---|---|---|---|
| CVE-2015-1427 | The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to by... | < 1.3.8 ≥ 1.4.0 < 1.4.3 | 9.8 | KEV | 99.9% | 2015-02-18 |
| CVE-2014-3120 | The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers... | < 1.2.0 | 8.1 | KEV | 88.6% | 2014-07-29 |
| CVE-2026-115715 | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 ≤ 8.19.23 ≥ 9.0.0 ≤ 9.4.8 ≥ 9.5.0 ≤ 9.5.5 | 6.5 | — | 2026-11-04 | |
| CVE-2026-115710 | Use of Cache Containing Sensitive Information in Elasticsearch Leading to Information Disclosure | ≥ 8.9.0 ≤ 8.19.23 ≥ 9.0.0 ≤ 9.4.8 ≥ 9.5.0 ≤ 9.5.5 | 4.2 | — | 2026-11-04 | |
| CVE-2026-115298 | Incorrect Authorization in Elasticsearch Leading to Information Disclosure | ≥ 8.0.0 ≤ 8.19.23 ≥ 9.0.0 ≤ 9.4.8 ≥ 9.5.0 ≤ 9.5.5 | 4.3 | — | 2026-11-04 | |
| CVE-2026-115290 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | ≥ 8.10.0 ≤ 8.19.23 ≥ 9.0.0 ≤ 9.4.8 ≥ 9.5.0 ≤ 9.5.5 | 7.5 | — | 2026-11-04 | |
| CVE-2026-103009 | Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure | ≥ 8.13.0 < 8.19.23 ≥ 9.0.0 < 9.4.8 ≥ 9.5.0 < 9.5.5 | 7.1 | — | 2026-10-07 | |
| CVE-2026-103008 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | ≥ 8.12.0 < 8.19.23 ≥ 9.0.0 < 9.4.8 ≥ 9.5.0 < 9.5.5 | 6.5 | — | 2026-10-07 | |
| CVE-2026-103007 | Incorrect Authorization in Elasticsearch Leading to Privilege Escalation | ≥ 8.16.0 < 8.19.22 ≥ 9.0.0 < 9.4.7 ≥ 9.5.0 < 9.5.4 | 7.2 | — | 2026-10-07 | |
| CVE-2026-103006 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.21 ≥ 9.0.0 < 9.4.6 ≥ 9.5.0 < 9.5.2 | 6.5 | — | 2026-10-07 | |
| CVE-2026-103005 | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service | ≥ 8.12.0 < 8.19.23 ≥ 9.0.0 ≤ 9.3.8 ≥ 9.4.0 < 9.4.8 | 6.5 | — | 2026-10-07 | |
| CVE-2026-102411 | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.23 ≥ 9.0.0 < 9.4.7 ≥ 9.5.0 < 9.5.3 | 6.5 | — | 2026-10-07 | |
| CVE-2026-102409 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | ≥ 9.2.0 < 9.4.8 ≥ 9.5.0 < 9.5.5 ≥ 9.2.0 ≤ 9.2.8 | 6.5 | — | 2026-10-07 | |
| CVE-2026-102408 | Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service | ≥ 8.19.0 < 8.19.22 ≥ 9.1.0 < 9.4.8 ≥ 9.5.0 < 9.5.5 | 4.3 | — | 2026-10-07 | |
| CVE-2026-102407 | Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification | ≥ 7.17.5 ≤ 7.17.29 ≥ 8.2.2 < 8.19.19 ≥ 9.0.0 < 9.3.8 | 5.4 | — | 2026-10-07 | |
| CVE-2026-102404 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.23 ≥ 9.0.0 < 9.4.8 ≥ 9.5.0 < 9.5.5 | 6.5 | — | 2026-10-07 | |
| CVE-2026-94408 | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service | ≥ 8.0.0 < 8.19.22 ≥ 9.0.0 < 9.4.7 ≥ 9.5.0 < 9.5.3 | 4.9 | — | 2026-09-27 | |
| CVE-2026-94397 | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service | ≥ 8.0.0 < 8.19.22 ≥ 9.0.0 < 9.4.7 ≥ 9.5.0 < 9.5.4 | 6.5 | — | 2026-09-27 | |
| CVE-2026-94396 | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service | ≥ 9.2.0 < 9.4.7 ≥ 9.5.0 < 9.5.4 ≥ 9.2.0 ≤ 9.4.6 | 6.5 | — | 2026-09-27 | |
| CVE-2026-94399 | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service | ≥ 8.0.0 < 8.19.22 ≥ 9.0.0 < 9.4.7 ≥ 9.5.0 < 9.5.4 | 6.5 | — | 2026-09-27 | |
| CVE-2026-94398 | Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service | ≥ 8.12.0 < 8.19.22 ≥ 9.0.0 < 9.4.7 ≥ 9.5.0 < 9.5.4 | 6.5 | — | 2026-09-27 | |
| CVE-2026-82300 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.22 ≥ 9.0.0 < 9.4.7 ≥ 9.5.0 < 9.5.4 | 6.5 | — | 2026-09-27 | |
| CVE-2026-82294 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.21 ≥ 9.0.0 < 9.4.6 ≥ 9.5.0 < 9.5.3 | 6.5 | — | 2026-09-27 | |
| CVE-2026-78607 | Missing Authorization in Elasticsearch Leading to Information Disclosure | ≥ 8.0.0 < 8.19.19 ≥ 9.0.0 < 9.3.8 ≥ 9.4.0 < 9.4.4 | 5.4 | — | 2026-09-02 | |
| CVE-2026-78605 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Informatio... | ≥ 8.18.0 < 8.19.20 ≥ 9.0.0 < 9.4.5 = 9.5.0 | 5.9 | — | 2026-09-02 | |
| CVE-2026-72649 | Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution | ≥ 8.0.0 < 8.19.20 ≥ 9.0.0 < 9.4.5 = 9.5.0 | 8.8 | — | 2026-09-02 | |
| CVE-2026-56143 | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.20 ≥ 9.0.0 < 9.3.0 ≥ 8.0.0 ≤ 8.19.19 | 4.9 | — | 2026-09-02 | |
| CVE-2026-72636 | Uncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of Service | ≥ 8.0.0 < 8.19.20 ≥ 9.0.0 < 9.4.5 ≥ 8.0.0 ≤ 8.19.19 | 6.5 | — | 2026-08-14 | |
| CVE-2026-72642 | Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process | ≥ 8.19.0 < 8.19.20 ≥ 9.4.0 < 9.4.5 ≥ 9.5.0 < 9.5.1 | 8.8 | — | 2026-08-14 | |
| CVE-2026-72639 | Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service | ≥ 8.19.0 < 8.19.20 ≥ 9.3.0 < 9.4.5 ≥ 9.5.0 < 9.5.1 | 6.5 | — | 2026-08-14 | |
| CVE-2026-72638 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.20 ≥ 9.0.0 < 9.4.5 ≥ 8.0.0 ≤ 8.19.19 | 6.5 | — | 2026-08-14 | |
| CVE-2026-72647 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.20 ≥ 9.0.0 < 9.4.5 ≥ 8.0.0 ≤ 8.19.19 | 6.5 | — | 2026-08-14 | |
| CVE-2026-72645 | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.20 ≥ 9.0.0 < 9.4.5 ≥ 9.5.0 < 9.5.1 | 6.5 | — | 2026-08-14 | |
| CVE-2026-72656 | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service | ≥ 8.11.0 < 8.18.0 ≥ 8.11.0 ≤ 8.17.9 | 6.5 | — | 2026-08-14 | |
| CVE-2026-72679 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | ≥ 8.19.0 < 8.19.20 ≥ 9.0.0 < 9.4.5 ≥ 8.19.0 ≤ 8.19.19 | 6.5 | — | 2026-08-14 | |
| CVE-2026-72678 | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service | ≥ 8.19.0 < 8.19.20 ≥ 9.4.0 < 9.4.5 ≥ 9.5.0 < 9.5.1 | 6.5 | — | 2026-08-14 | |
| CVE-2026-72687 | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.20 ≥ 9.0.0 < 9.4.5 ≥ 9.5.0 < 9.5.1 | 6.5 | — | 2026-08-14 | |
| CVE-2026-72686 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.20 ≥ 9.0.0 < 9.4.5 ≥ 9.5.0 < 9.5.1 | 6.5 | — | 2026-08-14 | |
| CVE-2026-72685 | Inefficient Algorithmic Complexity in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.20 ≥ 9.0.0 < 9.4.5 ≥ 8.0.0 ≤ 8.19.19 | 4.3 | — | 2026-08-14 | |
| CVE-2026-72684 | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.20 ≥ 9.0.0 < 9.4.5 ≥ 8.0.0 ≤ 8.19.19 | 6.5 | — | 2026-08-14 | |
| CVE-2026-72683 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | ≥ 5.0.0 < 8.19.19 ≥ 9.3.0 < 9.3.8 ≥ 9.4.0 < 9.4.4 | 6.5 | — | 2026-08-14 | |
| CVE-2026-63263 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.19 ≥ 9.0.0 < 9.3.8 ≥ 9.4.0 < 9.4.4 | 6.5 | — | 2026-07-22 | |
| CVE-2026-63144 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | ≥ 8.19.0 < 8.19.19 ≥ 9.3.0 < 9.3.8 ≥ 9.4.0 < 9.4.4 | 6.5 | — | 2026-07-22 | |
| CVE-2026-63140 | Reachable Assertion in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.19 ≥ 9.0.0 < 9.3.8 ≥ 9.4.0 < 9.4.4 | 6.5 | — | 2026-07-22 | |
| CVE-2026-63136 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.15 ≥ 9.0.0 < 9.2.9 ≥ 9.3.0 < 9.3.4 | 6.5 | — | 2026-07-22 | |
| CVE-2026-56145 | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service | ≥ 8.0.0 < 8.19.18 ≥ 9.0.0 < 9.3.7 ≥ 9.4.0 < 9.4.4 | 6.5 | — | 2026-07-22 | |
| CVE-2026-56144 | Incorrect Authorization in Elasticsearch Leading to Information Disclosure | ≥ 8.12.0 < 8.19.18 ≥ 9.0.0 < 9.3.7 ≥ 9.4.0 < 9.4.4 | 5.3 | — | 2026-07-22 |
数据来源：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS 详见 https://www.first.org/epss）、endoflife.date。软件列表：awesome-selfhosted（CC BY-SA 3.0）。