How severe is CVE-2026-63140?

CVE-2026-63140 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2026-63140 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-63140?

CVE-2026-63140 affects Elastic Elasticsearch. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-63140?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-63140 published?

CVE-2026-63140 was published on 2026-07-21 and last updated on 2026-08-07.

CVE-2026-63140

CVE-2026-63140 is a medium-severity vulnerability in Elastic Elasticsearch with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-617.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 0% (15th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-617
Affected product: Elastic Elasticsearch
Published: 2026-07-21
Last modified: 2026-08-07

Description

Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats assertion failures as fatal errors, this terminates the affected node process. A low-privileged authenticated user with read access to at least one index can exploit this condition with a single request to cause a node to terminate, disrupting search availability. In a single-node deployment this fully stops Elasticsearch; in a multi-node cluster it reduces cluster capacity for each affected node.

Frequently asked questions

What is CVE-2026-63140?: Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats assertion failures as fatal errors, this terminates the affected node process. A low-privileged authenticated user with read access to at least one index can exploit this condition with a single request to cause a node to terminate, disrupting search availability. In a single-node deployment this fully stops Elasticsearch; in a multi-node cluster it reduces cluster capacity for each affected node.
How severe is CVE-2026-63140?: CVE-2026-63140 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2026-63140 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-63140?: CVE-2026-63140 affects Elastic Elasticsearch. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-63140?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-63140 published?: CVE-2026-63140 was published on 2026-07-21 and last updated on 2026-08-07.

References

https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-64/388565

Affected products (1)

cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*

More vulnerabilities in Elastic Elasticsearch

CVE-2015-5377 — Critical (CVSS 9.8): Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the…
CVE-2015-1427 — Critical (CVSS 9.8): The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the…
CVE-2020-7014 — High (CVSS 8.8): The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1…
CVE-2020-7009 — High (CVSS 8.8): Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an…
CVE-2018-3831 — High (CVSS 8.8): Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when…
CVE-2019-7611 — High (CVSS 8.1): A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document…

All CVEs affecting Elastic Elasticsearch →

Other CWE-617 (Reachable Assertion) vulnerabilities

CVE-2024-35884 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: udp: do not accept non-tunnel GSO skbs landing in…
CVE-2020-3615 — Critical (CVSS 9.8): Valid deauth/disassoc frames is dropped in case if RMF is enabled and some rouge peer keep on sending rogue…
CVE-2019-9795 — Critical (CVSS 9.8): A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by…
CVE-2026-52952 — High (CVSS 8.8): In the Linux kernel, the following vulnerability has been resolved: iommu: Fix WARN_ON in…
CVE-2026-31739 — High (CVSS 8.8): In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Add missing CRYPTO_ALG_ASYNC The…
CVE-2020-12417 — High (CVSS 8.8): Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in…

Browse all CWE-617 (Reachable Assertion) vulnerabilities →