org.elasticsearch:elasticsearch (Maven)
Advisories
67
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 8.16.2 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.elasticsearch</groupId><artifactId>elasticsearch</artifactId><version>8.16.2</version></dependency>gradle
implementation("org.elasticsearch:elasticsearch:8.16.2")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-mm3m-5497-xggg Elasticsearch Uncontrolled Resource Consumption Vulnerability |
High EPSS 0.65% |
< 7.17.25 | 7.17.25 |
| GHSA-mm3m-5497-xggg Elasticsearch Uncontrolled Resource Consumption Vulnerability |
High EPSS 0.65% |
>= 8.0.0-alpha1, < 8.16.0 | 8.16.0 |
| GHSA-5xm9-x7x4-4j5x Elasticsearch Vulnerable to Stack Overflow due to a Large Recursion |
High EPSS 0.58% |
>= 8.0.0-alpha1, < 8.15.1 | 8.15.1 |
| GHSA-5xm9-x7x4-4j5x Elasticsearch Vulnerable to Stack Overflow due to a Large Recursion |
High EPSS 0.58% |
>= 7.17.0, < 7.17.24 | 7.17.24 |
| GHSA-jgx4-7v3v-vwfm Elasticsearch allocation of resources without limits or throttling leads to crash |
High EPSS 0.65% |
< 7.17.21 | 7.17.21 |
| GHSA-jgx4-7v3v-vwfm Elasticsearch allocation of resources without limits or throttling leads to crash |
High EPSS 0.65% |
>= 8.0.0, < 8.13.3 | 8.13.3 |
| GHSA-5mpw-4546-2wcr Elasticsearch Incorrect Authorization vulnerability |
Medium EPSS 0.46% |
>= 8.16.0, < 8.16.2 | 8.16.2 |
| GHSA-5v8f-xx9m-wj44 Elasticsearch stores private key on disk unencrypted |
High EPSS 0.21% |
< 7.17.23 | 7.17.23 |
| GHSA-5v8f-xx9m-wj44 Elasticsearch stores private key on disk unencrypted |
High EPSS 0.21% |
>= 8.0.0-alpha1, < 8.13.0 | 8.13.0 |
| GHSA-2hjr-vmf3-xwvp Elasticsearch Insertion of Sensitive Information into Log File |
Medium EPSS 0.45% |
>= 8.0.0, < 8.11.2 | 8.11.2 |
| GHSA-2hjr-vmf3-xwvp Elasticsearch Insertion of Sensitive Information into Log File |
Medium EPSS 0.45% |
< 7.17.16 | 7.17.16 |
| GHSA-4q22-422g-m4pj Elasticsearch StackOverflow vulnerability |
Medium EPSS 0.62% |
>= 8.13.1, < 8.14.0 | 8.14.0 |
| GHSA-pw39-f3m5-cxfc Elasticsearch Uncaught Exception leading to crash |
Medium EPSS 0.68% |
>= 8.4.0, < 8.11.1 | 8.11.1 |
| GHSA-r3hx-qfh5-r9m7 Elasticsearch Incorrect Authorization vulnerability |
Medium EPSS 0.49% |
>= 8.10.0, < 8.13.0 | 8.13.0 |
| GHSA-w5gg-2q56-6h4f Elasticsearch Uncontrolled Resource Consumption vulnerability |
High EPSS 1.25% |
>= 7.0.0, < 7.17.19 | 7.17.19 |
| GHSA-w5gg-2q56-6h4f Elasticsearch Uncontrolled Resource Consumption vulnerability |
High EPSS 1.25% |
>= 8.0.0, < 8.13.0 | 8.13.0 |
| GHSA-285m-vhfq-xx4h Elasticsearch Improper Handling of Exceptional Conditions |
High EPSS 0.84% |
>= 7.0.0, < 7.17.14 | 7.17.14 |
| GHSA-285m-vhfq-xx4h Elasticsearch Improper Handling of Exceptional Conditions |
High EPSS 0.84% |
>= 8.0.0, < 8.10.3 | 8.10.3 |
| GHSA-qwrx-45xf-jjf7 Elasticsearch vulnerable to stack overflow in the search API |
High EPSS 61.07% |
>= 7.0.0, < 7.17.13 | 7.17.13 |
| GHSA-qwrx-45xf-jjf7 Elasticsearch vulnerable to stack overflow in the search API |
High EPSS 61.07% |
>= 8.0.0, < 8.9.1 | 8.9.1 |
| GHSA-2cqf-6xv9-f22w Elasticsearch vulnerable to Uncontrolled Resource Consumption |
High EPSS 2.05% |
>= 8.0.0, < 8.9.0 | 8.9.0 |
| GHSA-2cqf-6xv9-f22w Elasticsearch vulnerable to Uncontrolled Resource Consumption |
High EPSS 2.05% |
< 7.17.13 | 7.17.13 |
| GHSA-99pc-69q9-jxf2 Elasticsearch allows insertion of sensitive information into log files when using deprecated URIs |
Medium EPSS 0.24% |
>= 7.0.0, < 7.17.13 | 7.17.13 |
| GHSA-99pc-69q9-jxf2 Elasticsearch allows insertion of sensitive information into log files when using deprecated URIs |
Medium EPSS 0.24% |
>= 8.0.0, < 8.9.2 | 8.9.2 |
| GHSA-wh6w-69xc-5rq5 Improper Check for Unusual or Exceptional Conditions in Elasticsearch |
High EPSS 7.55% |
>= 8.0.0, < 8.2.1 | 8.2.1 |
| GHSA-hr65-qq6p-87r4 Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch |
Medium EPSS 1.19% |
>= 7.11.0, < 7.11.2 | 7.11.2 |
| GHSA-hr65-qq6p-87r4 Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch |
Medium EPSS 1.19% |
< 6.8.15 | 6.8.15 |
| GHSA-cqgv-256r-m9r8 Insertion of Sensitive Information into Log File in Elasticsearch |
Medium EPSS 1.47% |
>= 7.0.0, < 7.10.0 | 7.10.0 |
| GHSA-cqgv-256r-m9r8 Insertion of Sensitive Information into Log File in Elasticsearch |
Medium EPSS 1.47% |
< 6.8.14 | 6.8.14 |
| GHSA-c77j-p484-h84m Improper privilege management in elasticsearch |
Medium EPSS 1.40% |
< 6.8.12 | 6.8.12 |
| GHSA-c77j-p484-h84m Improper privilege management in elasticsearch |
Medium EPSS 1.40% |
>= 7.0.0, < 7.9.0 | 7.9.0 |
| GHSA-gfv5-grx2-9jw2 Improper Privilege Management in Elasticsearch |
High EPSS 1.88% |
>= 6.7.0, < 6.8.8 | 6.8.8 |
| GHSA-gfv5-grx2-9jw2 Improper Privilege Management in Elasticsearch |
High EPSS 1.88% |
>= 7.0.0, < 7.6.2 | 7.6.2 |
| GHSA-hxp8-r9g3-grfr Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch |
Medium EPSS 2.43% |
>= 6.7.0, < 6.8.4 | 6.8.4 |
| GHSA-hxp8-r9g3-grfr Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch |
Medium EPSS 2.43% |
>= 7.0.0, < 7.4.0 | 7.4.0 |
| GHSA-jqm6-m3j3-8gg9 Concurrent Execution using Shared Resource with Improper Synchronization in Elasticsearch |
Medium EPSS 1.01% |
< 6.8.2 | 6.8.2 |
| GHSA-jqm6-m3j3-8gg9 Concurrent Execution using Shared Resource with Improper Synchronization in Elasticsearch |
Medium EPSS 1.01% |
>= 7.0.0, < 7.2.1 | 7.2.1 |
| GHSA-x8q8-4hp5-463w Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch |
Medium EPSS 33.16% |
>= 1.5.0, < 1.5.2 | 1.5.2 |
| GHSA-x8q8-4hp5-463w Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch |
Medium EPSS 33.16% |
< 1.4.5 | 1.4.5 |
| GHSA-mrfm-jxgf-2h6v Elasticsearch Improper Access Control vulnerability Known exploited |
High EPSS 88.56% |
< 1.4.0.Beta1 | 1.4.0.Beta1 |
| GHSA-mrfm-jxgf-2h6v Elasticsearch Improper Access Control vulnerability Known exploited |
High EPSS 88.56% |
< 1.4.0.Beta1 | 1.4.0.Beta1 |
| GHSA-8699-m855-cwqf Cross-site scripting in Elasticsearch |
Medium EPSS 2.02% |
< 1.4.0.Beta1 | 1.4.0.Beta1 |
| GHSA-w94p-6mhw-4qxw Improper Access Control in Elasticsearch Known exploited |
High EPSS 99.91% |
>= 1.4.0, < 1.4.3 | 1.4.3 |
| GHSA-w94p-6mhw-4qxw Improper Access Control in Elasticsearch Known exploited |
High EPSS 99.91% |
< 1.3.8 | 1.3.8 |
| GHSA-fh5x-4j57-6q5x Improper Access Control in Elasticsearch |
High EPSS 4.45% |
< 1.6.0 | 1.6.0 |
| GHSA-jjq8-vfjq-j6v4 Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch |
Medium EPSS 94.79% |
< 1.6.1 | 1.6.1 |
| GHSA-ccmr-qj26-845g Improper Restriction of XML External Entity Reference in Elasticsearch |
Medium EPSS 1.38% |
>= 6.5.0, < 6.5.2 | 6.5.2 |
| GHSA-vpqm-88c4-x4cv Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch |
Medium EPSS 1.46% |
>= 6.4.0, < 6.4.3 | 6.4.3 |
| GHSA-mjpc-qx7h-r8c9 Elasticsearch subject to cross site scripting |
Medium EPSS 0.89% |
>= 6.0.0, < 6.2.4 | 6.2.4 |
| GHSA-mjpc-qx7h-r8c9 Elasticsearch subject to cross site scripting |
Medium EPSS 0.89% |
< 5.6.9 | 5.6.9 |
| GHSA-r9fv-qpm9-rj4g Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch |
High EPSS 1.98% |
>= 5.6.0, < 5.6.12 | 5.6.12 |
| GHSA-r9fv-qpm9-rj4g Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch |
High EPSS 1.98% |
>= 6.0.0, < 6.4.1 | 6.4.1 |
| GHSA-fj32-6v7m-57pg Improper Access Control in Elasticsearch |
High EPSS 2.15% |
< 5.6.15 | 5.6.15 |
| GHSA-fj32-6v7m-57pg Improper Access Control in Elasticsearch |
High EPSS 2.15% |
>= 6.0.0, < 6.6.1 | 6.6.1 |
| GHSA-pgq6-ccqj-hpqr Elasticsearch privilege escalation |
Medium EPSS 1.03% |
>= 7.16.0, < 7.17.1 | 7.17.1 |
| GHSA-m6gg-86c6-gfr9 Withdrawn: Cross-site Scripting in Kibana Withdrawn |
Medium EPSS 0.77% |
>= 7.16.0, < 7.17.1 | 7.17.1 |
| GHSA-45h5-r968-5xr7 Exposure of sensitive information in Elasticsearch |
Medium EPSS 1.04% |
>= 7.11.0, < 7.14.0 | 7.14.0 |
| GHSA-3393-hvrj-w7v3 Denial of Service in Elasticsearch |
Medium EPSS 2.44% |
< 6.8.17 | 6.8.17 |
| GHSA-3393-hvrj-w7v3 Denial of Service in Elasticsearch |
Medium EPSS 2.44% |
>= 7.0.0-alpha1, < 7.13.3 | 7.13.3 |
| GHSA-62ww-4p3p-7fhj API information disclosure flaw in Elasticsearch |
Medium EPSS 1.34% |
< 6.8.15 | 6.8.15 |
| GHSA-62ww-4p3p-7fhj API information disclosure flaw in Elasticsearch |
Medium EPSS 1.34% |
>= 7.0.0, < 7.11.2 | 7.11.2 |
| GHSA-5fvx-2jj3-6mff Insufficiently Protected Credentials in Elasticsearch |
Medium EPSS 1.22% |
>= 7.7.0, < 7.10.2 | 7.10.2 |
| GHSA-hqqv-9x3v-mp7w Privilege Escalation Flaw in Elasticsearch |
High EPSS 1.74% |
>= 7.0.0, < 7.6.2 | 7.6.2 |
| GHSA-hqqv-9x3v-mp7w Privilege Escalation Flaw in Elasticsearch |
High EPSS 1.74% |
>= 6.7.0, < 6.8.8 | 6.8.8 |
| GHSA-g9fw-9x87-rmrj Privilege Context Switching Error in Elasticsearch |
Low EPSS 1.08% |
< 6.8.13 | 6.8.13 |
| GHSA-g9fw-9x87-rmrj Privilege Context Switching Error in Elasticsearch |
Low EPSS 1.08% |
>= 7.0.0, < 7.9.2 | 7.9.2 |
| GHSA-hwvv-438r-mhvj Exposure of Sensitive Information to an Unauthorized Actor |
Medium EPSS 1.11% |
>= 7.6.0, < 7.11.0 | 7.11.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor