Executive brief
Elasticsearch, a widely used search and analytics engine, is vulnerable to a flaw that allows an attacker to crash the service. By sending a specially crafted search request, a user with basic access can force the system to shut down unexpectedly. This results in a denial of service, potentially stopping all search operations or reducing the performance of the entire cluster.
Technical details
A Reachable Assertion (CWE-617) exists in Elasticsearch during query parsing. When a search request contains a null value in a specific query clause, it triggers an internal assertion that Elasticsearch treats as a fatal error, leading to immediate process termination. The attack requires network connectivity and a low-privileged authenticated user with read access to at least one index. Exploitation results in a Denial of Service (DoS) for the affected node. The issue is resolved in versions 8.19.19, 9.3.8, and 9.4.4; versions 9.5.0 and later are unaffected.
Affected products
- Elastic Elasticsearch 8.0.0 to 8.19.18, 9.0.0 to 9.3.7, 9.4.0 to 9.4.3
Timeline
- 2026-07-21: disclosed
- 2026-07-21: advisory
- 2026-07-21: patched: Fixed in 8.19.19, 9.3.8, and 9.4.4