CVE-2026-63140 Details
Description
Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats assertion failures as fatal errors, this terminates the affected node process. A low-privileged authenticated user with read access to at least one index can exploit this condition with a single request to cause a node to terminate, disrupting search availability. In a single-node deployment this fully stops Elasticsearch; in a multi-node cluster it reduces cluster capacity for each affected node.
A reachable assertion vulnerability has been identified in Elasticsearch versions 8.0.0 prior to 8.19.18, as well as in 9.0.0 prior to 9.3.7 and 9.4.0 prior to 9.4.3. This vulnerability allows a low-privileged authenticated user with read access to at least one index to manipulate input data by sending a specially crafted search request. The request must include a null value in a specific query clause, which triggers an internal assertion failure during query parsing. Elasticsearch treats such assertion failures as fatal errors, causing the affected node process to terminate. This disruption halts search availability, fully stopping Elasticsearch in single-node deployments or reducing cluster capacity in multi-node environments.
Users can upgrade to Elasticsearch versions 8.19.19, 9.3.8, or 9.4.4 to address this vulnerability. For those unable to upgrade, no workarounds are available.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-64/388565 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-617 | Reachable Assertion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| elastic elasticsearch | >= 8.0.0, < 8.19.19 >= 9.0.0, < 9.3.8 >= 9.4.0, < 9.4.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | Initial Analysis | [email protected] |
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |