# org.elasticsearch:elasticsearch (Maven) vulnerabilities Source: https://junglewise.ai/threats/technologies/org-elasticsearch-elasticsearch Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/org-elasticsearch-elasticsearch.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 41 vulnerabilities in org.elasticsearch:elasticsearch (Maven): 0 in the last 7 days and 0 in the last 90 days, 2 of them critical and 2 exploited in the wild. The most recent, CVE-2024-52979, was published on 1 May 2025. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 41 (2 critical, 2 exploited in the wild) ## About org.elasticsearch:elasticsearch (Maven) Elasticsearch is a search and analytics engine for distributed data indexing and retrieval. ## Latest org.elasticsearch:elasticsearch (Maven) vulnerabilities - [CVE-2024-52979: Elasticsearch Uncontrolled Resource Consumption Vulnerability](https://junglewise.ai/threats/cve-2024-52979-elasticsearch-uncontrolled-resource-consumption-vulnerability) (low, CVSS 3.1, published 1 May 2025) - [CVE-2024-52981: Elasticsearch Vulnerable to Stack Overflow due to a Large Recursion](https://junglewise.ai/threats/cve-2024-52981-elasticsearch-vulnerable-to-stack-overflow-due-to-a-large) (low, CVSS 3.1, published 8 Apr 2025) - [CVE-2024-43709: Elasticsearch allocation of resources without limits or throttling leads to crash](https://junglewise.ai/threats/cve-2024-43709-elasticsearch-allocation-of-resources-without-limits-or) (low, CVSS 3.1, published 21 Jan 2025) - [CVE-2024-12539: Elasticsearch Incorrect Authorization vulnerability](https://junglewise.ai/threats/cve-2024-12539-elasticsearch-incorrect-authorization-vulnerability) (medium, CVSS 4, published 17 Dec 2024) - [CVE-2024-23444: Elasticsearch stores private key on disk unencrypted](https://junglewise.ai/threats/cve-2024-23444-elasticsearch-stores-private-key-on-disk-unencrypted) (low, CVSS 3.1, published 31 Jul 2024) - [CVE-2023-49921: Elasticsearch Insertion of Sensitive Information into Log File](https://junglewise.ai/threats/cve-2023-49921-elasticsearch-insertion-of-sensitive-information-into-log-file) (low, CVSS 3.1, published 26 Jul 2024) - [CVE-2024-37280: Elasticsearch StackOverflow vulnerability](https://junglewise.ai/threats/cve-2024-37280-elasticsearch-stackoverflow-vulnerability) (low, CVSS 3.1, published 13 Jun 2024) - [CVE-2024-23449: Elasticsearch Uncaught Exception leading to crash](https://junglewise.ai/threats/cve-2024-23449-elasticsearch-uncaught-exception-leading-to-crash) (low, CVSS 3.1, published 29 Mar 2024) - [CVE-2024-23451: Elasticsearch Incorrect Authorization vulnerability](https://junglewise.ai/threats/cve-2024-23451-elasticsearch-incorrect-authorization-vulnerability) (low, CVSS 3.1, published 27 Mar 2024) - [CVE-2024-23450: Elasticsearch Uncontrolled Resource Consumption vulnerability](https://junglewise.ai/threats/cve-2024-23450-elasticsearch-uncontrolled-resource-consumption-vulnerability) (low, CVSS 3.1, published 27 Mar 2024) - [CVE-2023-46673: Elasticsearch Improper Handling of Exceptional Conditions](https://junglewise.ai/threats/cve-2023-46673-elasticsearch-improper-handling-of-exceptional-conditions) (low, CVSS 3.1, published 22 Nov 2023) - [CVE-2023-31417: Elasticsearch allows insertion of sensitive information into log files when using deprecated URIs](https://junglewise.ai/threats/cve-2023-31417-elasticsearch-allows-insertion-of-sensitive-information-into-log) (low, CVSS 3.1, published 26 Oct 2023) - [CVE-2023-31418: Elasticsearch vulnerable to Uncontrolled Resource Consumption](https://junglewise.ai/threats/cve-2023-31418-elasticsearch-vulnerable-to-uncontrolled-resource-consumption) (low, CVSS 3.1, published 26 Oct 2023) - [CVE-2023-31419: Elasticsearch vulnerable to stack overflow in the search API](https://junglewise.ai/threats/cve-2023-31419-elasticsearch-vulnerable-to-stack-overflow-in-the-search-api) (low, CVSS 3.1, published 26 Oct 2023) - [CVE-2022-23712: Improper Check for Unusual or Exceptional Conditions in Elasticsearch](https://junglewise.ai/threats/cve-2022-23712-improper-check-for-unusual-or-exceptional-conditions-in) (low, CVSS 3.1, published 7 Jun 2022) - [CVE-2021-22137: Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch](https://junglewise.ai/threats/cve-2021-22137-exposure-of-sensitive-information-to-an-unauthorized-actor-in) (low, CVSS 3.1, published 24 May 2022) - [CVE-2020-7021: Insertion of Sensitive Information into Log File in Elasticsearch](https://junglewise.ai/threats/cve-2020-7021-insertion-of-sensitive-information-into-log-file-in-elasticsearch) (low, CVSS 3.1, published 24 May 2022) - [CVE-2020-7019: Improper privilege management in elasticsearch](https://junglewise.ai/threats/cve-2020-7019-improper-privilege-management-in-elasticsearch) (low, CVSS 3.1, published 24 May 2022) - [CVE-2020-7009: Improper Privilege Management in Elasticsearch](https://junglewise.ai/threats/cve-2020-7009-improper-privilege-management-in-elasticsearch) (low, CVSS 3.1, published 24 May 2022) - [CVE-2019-7619: Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch](https://junglewise.ai/threats/cve-2019-7619-exposure-of-sensitive-information-to-an-unauthorized-actor-in) (low, CVSS 3.1, published 24 May 2022) - [CVE-2019-7614: Concurrent Execution using Shared Resource with Improper Synchronization in Elasticsearch](https://junglewise.ai/threats/cve-2019-7614-concurrent-execution-using-shared-resource-with-improper) (low, CVSS 3, published 24 May 2022) - [CVE-2015-3337: Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch](https://junglewise.ai/threats/cve-2015-3337-improper-limitation-of-a-pathname-to-a-restricted-directory-in) (info, published 17 May 2022) - [CVE-2014-3120: Elasticsearch Improper Access Control vulnerability](https://junglewise.ai/threats/cve-2014-3120-elasticsearch-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 17 May 2022) - [CVE-2014-6439: Cross-site scripting in Elasticsearch](https://junglewise.ai/threats/cve-2014-6439-cross-site-scripting-in-elasticsearch) (info, published 14 May 2022) - [CVE-2015-1427: Improper Access Control in Elasticsearch](https://junglewise.ai/threats/cve-2015-1427-elasticsearch-groovy-scripting-engine-remote-code-execution) (critical, exploited in the wild, CVSS 9.8, published 14 May 2022) ## Most severe org.elasticsearch:elasticsearch (Maven) vulnerabilities - [CVE-2015-1427: Improper Access Control in Elasticsearch](https://junglewise.ai/threats/cve-2015-1427-elasticsearch-groovy-scripting-engine-remote-code-execution) (critical, exploited in the wild, CVSS 9.8, published 14 May 2022) - [CVE-2014-3120: Elasticsearch Improper Access Control vulnerability](https://junglewise.ai/threats/cve-2014-3120-elasticsearch-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 17 May 2022) - [CVE-2024-12539: Elasticsearch Incorrect Authorization vulnerability](https://junglewise.ai/threats/cve-2024-12539-elasticsearch-incorrect-authorization-vulnerability) (medium, CVSS 4, published 17 Dec 2024) - [CVE-2023-31419: Elasticsearch vulnerable to stack overflow in the search API](https://junglewise.ai/threats/cve-2023-31419-elasticsearch-vulnerable-to-stack-overflow-in-the-search-api) (low, CVSS 3.1, published 26 Oct 2023) - [CVE-2022-23712: Improper Check for Unusual or Exceptional Conditions in Elasticsearch](https://junglewise.ai/threats/cve-2022-23712-improper-check-for-unusual-or-exceptional-conditions-in) (low, CVSS 3.1, published 7 Jun 2022) - [CVE-2019-7619: Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch](https://junglewise.ai/threats/cve-2019-7619-exposure-of-sensitive-information-to-an-unauthorized-actor-in) (low, CVSS 3.1, published 24 May 2022) - [CVE-2021-22144: Denial of Service in Elasticsearch](https://junglewise.ai/threats/cve-2021-22144-denial-of-service-in-elasticsearch) (low, CVSS 3.1, published 9 Aug 2021) - [CVE-2019-7611: Improper Access Control in Elasticsearch](https://junglewise.ai/threats/cve-2019-7611-improper-access-control-in-elasticsearch) (low, CVSS 3.1, published 13 May 2022) - [CVE-2023-31418: Elasticsearch vulnerable to Uncontrolled Resource Consumption](https://junglewise.ai/threats/cve-2023-31418-elasticsearch-vulnerable-to-uncontrolled-resource-consumption) (low, CVSS 3.1, published 26 Oct 2023) - [CVE-2018-3831: Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch](https://junglewise.ai/threats/cve-2018-3831-exposure-of-sensitive-information-to-an-unauthorized-actor-in) (low, CVSS 3.1, published 13 May 2022) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Maven technologies - [org.jenkins-ci.main:jenkins-core (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core): 259 vulnerabilities - [org.apache.tomcat:tomcat (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat): 169 vulnerabilities - [com.liferay.portal:release.portal.bom (Maven)](https://junglewise.ai/threats/technologies/com-liferay-portal-release-portal-bom): 159 vulnerabilities - [com.liferay.portal:release.dxp.bom (Maven)](https://junglewise.ai/threats/technologies/com-liferay-portal-release-dxp-bom): 125 vulnerabilities - [org.keycloak:keycloak-services (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-services): 122 vulnerabilities - [com.fasterxml.jackson.core:jackson-databind (Maven)](https://junglewise.ai/threats/technologies/com-fasterxml-jackson-core-jackson-databind): 86 vulnerabilities - [org.apache.tomcat.embed:tomcat-embed-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-embed-tomcat-embed-core): 83 vulnerabilities - [org.apache.struts:struts2-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-struts-struts2-core): 60 vulnerabilities - [org.keycloak:keycloak-core (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-core): 57 vulnerabilities - [org.xwiki.platform:xwiki-platform-oldcore (Maven)](https://junglewise.ai/threats/technologies/org-xwiki-platform-xwiki-platform-oldcore): 46 vulnerabilities - [org.apache.tomcat:tomcat-catalina (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-catalina): 44 vulnerabilities - [io.undertow:undertow-core (Maven)](https://junglewise.ai/threats/technologies/io-undertow-undertow-core): 40 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "org.elasticsearch:elasticsearch (Maven) vulnerabilities", https://junglewise.ai/threats/technologies/org-elasticsearch-elasticsearch, 9 November 2026.