CVE-2026-63140

{
  "id": "CVE-2026-63140",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-21T21:16:53.073",
  "lastModified": "2026-10-24T19:10:00.127",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats assertion failures as fatal errors, this terminates the affected node process. A low-privileged authenticated user with read access to at least one index can exploit this condition with a single request to cause a node to terminate, disrupting search availability. In a single-node deployment this fully stops Elasticsearch; in a multi-node cluster it reduces cluster capacity for each affected node."
    },
    {
      "lang": "es",
      "value": "Una Aserción Alcanzable (CWE-617) en Elasticsearch puede llevar a una denegación de servicio a través de la Manipulación de Datos de Entrada (CAPEC-153). Una solicitud de búsqueda especialmente diseñada que contiene un valor nulo en una cláusula de consulta específica provoca que se genere una aserción interna durante el análisis de la consulta. Debido a que Elasticsearch trata los fallos de aserción como errores fatales, esto termina el proceso del nodo afectado. Un usuario autenticado con bajos privilegios y acceso de lectura a al menos un índice puede explotar esta condición con una única solicitud para provocar la terminación de un nodo, interrumpiendo la disponibilidad de búsqueda. En una implementación de un solo nodo, esto detiene completamente Elasticsearch; en un clúster de varios nodos, reduce la capacidad del clúster para cada nodo afectado."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Elastic",
          "product": "Elasticsearch",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "9.0.0",
              "lessThanOrEqual": "9.3.7",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "9.4.0",
              "lessThanOrEqual": "9.4.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.0.0",
              "lessThanOrEqual": "8.19.18",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T19:31:58.094155Z",
          "id": "CVE-2026-63140",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-617"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.0.0",
              "versionEndExcluding": "8.19.19",
              "matchCriteriaId": "96C3FAF7-B843-402F-A3C1-543138429355"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "9.0.0",
              "versionEndExcluding": "9.3.8",
              "matchCriteriaId": "EDAA3E3F-D854-4D29-BB31-20A947C9EB1A"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "9.4.0",
              "versionEndExcluding": "9.4.4",
              "matchCriteriaId": "54F14824-0093-4DA8-95AD-ED8F481722FC"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-64/388565",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}