# Elasticsearch 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-235)

**URL:** <https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-235/391372>\
**Category:** Security Announcements\
**Created:** [November 3, 2026, 4:33pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-235/391372 "2026-11-03T16:33:07Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bryan\_Garcia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bryan_garcia/32/148179_2.png) [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\
**Post date:** [November 3, 2026, 4:33pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-235/391372/1 "2026-11-03T16:33:07Z")

</div>

**Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service**

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an affected phonetic encoder of the analysis-phonetic plugin. An authenticated user with permission to write documents to or run searches against an index that uses an affected encoder can cause an Elasticsearch node to exhaust its heap memory. The node can become unresponsive or terminate.

**Affected Versions:**

> - 8.x: All versions from 8.0.0 up to and including 8.19.23
> - 9.x:

- All versions from 9.0.0 up to and including 9.4.8
- All versions from 9.5.0 up to and including 9.5.5

**Affected Configurations:**

> - Clusters that have the analysis-phonetic plugin installed and at least one index with an analyzer that uses the koelnerphonetik or haasephonetik encoder. Other phonetic encoders are not affected. Clusters without the analysis-phonetic plugin are not affected.

**Solutions and Mitigations:**

The issue is resolved in version 8.19.24, 9.4.9 and 9.5.6.

**For Users that Cannot Upgrade:**

> - Stop using the koelnerphonetik and haasephonetik encoders in index analyzers. To change the analyzer of an existing field, create a new index with an updated mapping and reindex the data into it. This workaround applies to self-managed and Elastic Cloud Hosted deployments.

**Indicators of Compromise (IOC)**

No specific indicators of compromise have been identified for this vulnerability.

**Elastic Cloud Serverless**

Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.

**Severity:** CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H  
**CVE ID:** CVE-2026-115715  
**Problem Type:** CWE-770 - Allocation of Resources Without Limits or Throttling