Reachable Assertion in Elasticsearch Leading to Denial of Service
Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats assertion failures as fatal errors, this terminates the affected node process. A low-privileged authenticated user with read access to at least one index can exploit this condition with a single request to cause a node to terminate, disrupting search availability. In a single-node deployment this fully stops Elasticsearch; in a multi-node cluster it reduces cluster capacity for each affected node.
Affected Versions:
- 8.x: All versions from 8.0.0 up to and including 8.19.18
- 9.x:
- All versions from 9.0.0 up to and including 9.3.7
- All versions from 9.4.0 up to and including 9.4.3
Users on the 9.5.x release line are not affected. The fix was incorporated into 9.5.0 before its initial release.
Affected Configurations:
- All configurations of Elasticsearch are affected. Exploitation requires an authenticated user with at least read access to one index; no elevated administrative privileges are needed.
Solutions and Mitigations:
The issue is resolved in versions 8.19.19, 9.3.8, and 9.4.4.
For Users that Cannot Upgrade:
- There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE ID: CVE-2026-63140
Problem Type: CWE-617 - Reachable Assertion
Impact: CAPEC-153 - Input Data Manipulation