Elasticsearch CVE-2026-115715

Requires that the optional analysis-phonetic plugin be installed and that a target index be configured to use an affected phonetic encoder - this is not a default Elasticsearch configuration. The attacker must be an authenticated user holding permission to write documents to, or run searches against, that specific index (CVSS PR:L). Given those prerequisites, the crafted input is delivered remotely over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). Limiting factors: dependence on the non-default phonetic plugin and encoder configuration, plus the requirement for pre-existing authenticated index access, meaningfully narrow the exploitable population below the raw CVSS score; impact is confined to availability (node unresponsiveness or termination).

This is a moderate-severity availability-only issue, not a drop-everything emergency, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5) describes a network-reachable, low-complexity attack that nonetheless requires authentication (PR:L) and yields only availability impact - no confidentiality or integrity loss. The vuln.today decision label is 'this_month', indicating a plan-and-patch priority rather than act_now/emergency. There is no CISA KEV listing and no EPSS score supplied, and the single reference is Elastic's own security advisory (ESA-2026-235), not exploit code - so there is no public exploit identified at time of analysis. The practical risk is further bounded because exploitation depends on a non-default configuration: the optional analysis-phonetic plugin must be installed and an index must use an affected phonetic encoder, and the attacker must already hold write-or-search permission on that index. Net assessment: a legitimate but not urgent issue for environments that actually run the phonetic plugin; for the large majority of Elasticsearch deployments that do not install it, real-world exposure is low. EPSS is absent, so probabilistic exploitation likelihood could not be weighed.

An authenticated user who can write documents to or run searches against an index configured with an affected phonetic encoder submits a specially crafted input value. The analysis-phonetic plugin allocates memory for that value without limits (CWE-770), exhausting the node's heap so it becomes unresponsive or terminates. Because the CVSS vector is AV:N/AC:L, the request is remote and low-complexity, but the attacker must first hold valid credentials with index write/search access; no public exploit code was identified.