EUVD-2026-46433
GHSA-h663-9fgh-w7xf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable REST API with low-privilege auth sufficient; single null-value request achieves full node termination with no confidentiality or integrity impact.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
2DescriptionCVE.org
Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats assertion failures as fatal errors, this terminates the affected node process. A low-privileged authenticated user with read access to at least one index can exploit this condition with a single request to cause a node to terminate, disrupting search availability. In a single-node deployment this fully stops Elasticsearch; in a multi-node cluster it reduces cluster capacity for each affected node.
AnalysisAI
Node process termination in Elasticsearch allows a low-privileged authenticated user to crash any reachable cluster node with a single malformed search request. The vulnerability stems from a reachable assertion in the query parsing layer triggered by a null value in a specific query clause; because Elasticsearch treats assertion failures as fatal, the node process exits immediately. Single-node deployments lose service entirely; in clustered environments, each targeted node reduces available search capacity. No public exploit has been identified at time of analysis, and Elastic has released patched versions 8.19.19, 9.3.8, and 9.4.4 per advisory ESA-2026-64.
Technical ContextAI
Elasticsearch (CPE: cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*) is a distributed search and analytics engine built on Apache Lucene, exposing a REST HTTP API for query execution. The root cause is CWE-617 (Reachable Assertion): internal assertions used during development to enforce invariants remain reachable in production code. When the query parser encounters a null value in a specific query clause, it evaluates an assertion that evaluates to false, raising an AssertionError. Because the JVM running Elasticsearch is configured to treat unhandled assertion failures as fatal, the entire node process terminates rather than returning an error to the client. CAPEC-153 (Input Data Manipulation) describes the attacker technique: crafting input to violate internal program assumptions rather than exploiting memory corruption. The null-value trigger in a query clause is a low-cost, repeatable manipulation requiring no special encoding or timing.
RemediationAI
Upgrade Elasticsearch to version 8.19.19 on the 8.x branch, 9.3.8 on the 9.3.x branch, or 9.4.4 on the 9.4.x branch, as documented in Elastic security advisory ESA-2026-64 at https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-64/388565. For environments that cannot immediately patch, the most effective compensating control is to restrict API access to the Elasticsearch HTTP endpoint (default port 9200) to trusted internal networks and service accounts only, eliminating the network exposure from untrusted authenticated users. Additionally, auditing and tightening index-level read permissions to reduce the population of principals who can issue search queries will limit the blast radius. Note that neither network restriction nor permission tightening eliminates the vulnerability - they reduce attacker access but do not patch the assertion flaw. Rolling restarts on patched nodes are preferable to full cluster downtime in high-availability deployments.
More in Elasticsearch
View allDirectory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause
All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. Rated medium severit
Remote code execution in Elasticsearch's machine learning component allows an authenticated user with ML model deploymen
Heap corruption and potential remote code execution in Elasticsearch's native ML inference engine can be triggered by an
The fix for CVE-2020-7009 was found to be incomplete. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker
Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secre
A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Le
The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files
Same weakness CWE-617 – Reachable Assertion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today