# Elasticsearch 8.19.10, 9.1.10, 9.2.4 Security Update (ESA-2026-07)

**URL:** https://discuss.elastic.co/t/elasticsearch-8-19-10-9-1-10-9-2-4-security-update-esa-2026-07/384525
**Category:** Security Announcements
**Created:** [January 13, 2026, 8:55pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-10-9-1-10-9-2-4-security-update-esa-2026-07/384525 "2026-01-13T20:55:33Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![ismisepaul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismisepaul/32/102235_2.png) [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)
#### Post date: [January 13, 2026, 8:55pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-10-9-1-10-9-2-4-security-update-esa-2026-07/384525/1 "2026-01-13T20:55:33Z")

</div>

**Elasticsearch yawkat LZ4 Java - CVE-2025-66566 (ESA-2026-07)**

An Information Disclosure vulnerability (CVE-2025-66566) exists in the yawkat LZ4 Java library used by Elasticsearch that allows an attacker to read previous buffer contents through specially crafted compressed input sent via the transport layer.

**Affected Versions:**

- 7.x: All versions from 7.14.0 up to and including 7.17.29
- 8.x: All versions from 8.0.0 up to and including 8.19.9
- 9.x:
  - All versions from 9.0.0 up to and including 9.1.9
  - All versions from 9.2.0 up to and including 9.2.3

**Solutions and Mitigations:**

Users should upgrade to version 8.19.10, 9.1.10, 9.2.4.

**For Users that Cannot Upgrade:**

**Self-hosted**

For users who cannot upgrade immediately, the following workarounds can be applied to `elasticsearch.yml`. Note that these changes require a node restart to take effect.

- Switch to Deflate: The LZ4 Java decompressor can be bypassed by switching the transport compression scheme to deflate: `transport.compression_scheme: deflate`
- Disable Compression: Compression can be disabled entirely, though this will result in increased network bandwidth usage: `transport.compress: false`
- Cross-Cluster Settings: If utilizing cross-cluster search or replication, apply the mitigation to remote connections: `cluster.remote.<cluster_alias>.transport.compression_scheme: deflate`

**Cloud**

For users on **Elastic Cloud** who cannot upgrade immediately:

- Configuration: The `transport.compression_scheme` setting can be configured by users in the Cloud Console for versions **7.17.0 and later**. Users can switch the scheme to `deflate` or disable compression via the user settings block.
- Remote Clusters: While users cannot configure `cluster.remote.<cluster_alias>.transport.compression_scheme` directly in the Cloud UI, remote cluster connections will automatically inherit the global `transport.compression_scheme` setting.

**Elastic Cloud Serverless**

Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.

**Severity:** CVSSv3.1: High (8.4) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N  
**CVE ID** : CVE-2025-66566