Elasticsearch 8.x < 8.19.19 / 9.0.x < 9.3.8 / 9.4.x < 9.4.4 Multiple Vulnerabilities (ESA-2026-64 / ESA-2026-68 / ESA-2026-74)

medium Nessus Plugin ID 330339

Synopsis

The remote host is missing a security update.

Description

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.19, or 9.0.x prior to 9.3.8, or 9.4.x prior to 9.4.4. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-64, ESA-2026-68, and ESA-2026-74 advisories.

- Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats assertion failures as fatal errors, this terminates the affected node process. (CVE-2026-63140)

- Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch query evaluation component, causing a fatal error that terminates the affected node. (CVE-2026-63144)

- Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. (CVE-2026-63263)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Elasticsearch version 8.19.19, 9.3.8, or 9.4.4 or later as appropriate for your release branch.

Plugin Details

Severity: Medium

ID: 330339

File Name: elasticsearch_ESA-2026-64.nasl

Version: 1.1

Type: Combined

Agent: unix

Family: Misc.

Published: 7/28/2026

Updated: 7/28/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.75

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-63140

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Vulnerability Information

CPE: cpe:/a:elastic:elasticsearch, cpe:/a:elasticsearch:elasticsearch

Required KB Items: installed_sw/Elasticsearch

Patch Publication Date: 7/21/2026

Vulnerability Publication Date: 7/21/2026

Reference Information

CVE: CVE-2026-63140, CVE-2026-63144, CVE-2026-63263

IAVA: 2026-A-0760

Detections

Analytics