{"id":"elastic-security-6c6e8d026358","seq":2812,"kind":"advisory","title":"Elasticsearch 8.19.22, 9.4.8, and 9.5.5 Security Update (ESA-2026-189)","url":"https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-189/390862","permalink":"https://vulnpulse.app/items/elastic-security-6c6e8d026358","summary":"Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-based index can submit a specially crafted regular expression that triggers cat…","severity":null,"techs":["elasticsearch"],"cves":[],"tags":["security"],"source":{"id":"elastic-security","name":"Elastic Security Announcements"},"published_at":"2026-10-06T18:39:39.000Z","fetched_at":"2026-10-21T16:17:47.217Z"}