Elasticsearch 8.19.22, 9.4.8, and 9.5.5 Security Update (ESA-2026-189)

Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-based index can submit a specially crafted regular expression that triggers cat…

Elastic Security Announcementsで読む

2026/10/07 03:39、Elastic Security Announcementsが「Elasticsearch 8.19.22, 9.4.8, and 9.5.5 Security Update (ESA-2026-189)」を公開しました (種別: 脆弱性アドバイザリ)。関連する技術: Elasticsearch / OpenSearch。