# Elastic Maps Server 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-238)

**URL:** <https://discuss.elastic.co/t/elastic-maps-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-238/391375>\
**Category:** Security Announcements\
**Tags:** docker\
**Created:** [November 3, 2026, 4:34pm UTC](https://discuss.elastic.co/t/elastic-maps-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-238/391375 "2026-11-03T16:34:16Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bryan\_Garcia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bryan_garcia/32/148179_2.png) [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\
**Post date:** [November 3, 2026, 4:34pm UTC](https://discuss.elastic.co/t/elastic-maps-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-238/391375/1 "2026-11-03T16:34:16Z")

</div>

**Out-of-bounds Write in Elastic Maps Server Leading to Remote Code Execution**

Out-of-bounds Write (CWE-787) in the Brotli decoder used by the Node.js runtime, a dependency of Elastic Maps Server (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to corrupt memory and potentially execute code in the Elastic Maps Server process via a specially crafted, malformed compressed response from Elasticsearch. Exploitation requires an attacker who controls the response from the Elasticsearch cluster that Elastic Maps Server connects to. The issue is tracked as CVE-2026-111497. The Elastic Maps Server Docker images include an affected version of the Brotli library. Elastic confirmed that the vulnerable decoder is reachable in Elastic Maps Server but did not reproduce memory corruption or code execution in Elastic Maps Server.

**Affected Versions:**

> - 8.x: All versions from 8.0.0 up to and including 8.19.23
> - 9.x:

- All versions from 9.0.0 up to and including 9.4.8
- All versions from 9.5.0 up to and including 9.5.5

**Affected Configurations:**

> - All Elastic Maps Server Docker images of the affected versions include an affected version of the Brotli library.
> - Elastic Maps Server decodes Brotli-compressed responses only from the configured Elasticsearch host, for example during the license check. Inbound requests to Elastic Maps Server, including requests from Kibana, cannot reach the decoder.
> - An attacker must control the Elasticsearch response. This requires a compromised Elasticsearch cluster, or interception and modification of the connection to Elasticsearch when TLS is not used or certificate verification is weakened (for example, elasticsearch.ssl.verificationMode set to none or certificate). The default verification mode is full.

**Solutions and Mitigations:**

The issue is resolved in version 8.19.24, 9.4.9, and 9.5.6. The Docker images of these versions include a Brotli library that contains the upstream fix.

The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the [known issues](https://www.elastic.co/docs/release-notes) for your target version before upgrading.

**For Users that Cannot Upgrade:**

There are no complete workarounds for this vulnerability. Keeping elasticsearch.ssl.verificationMode set to full (the default) prevents exploitation through interception of the connection to Elasticsearch. It does not protect against a compromised Elasticsearch cluster.

**Indicators of Compromise (IOC)**

No specific indicators of compromise have been identified for this vulnerability.

**Severity:** CVSSv3.1: High ( 8.1 ) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H  
**CVE ID:** CVE-2026-111497  
**Problem Type:** CWE-787 - Out-of-bounds Write