## Elasticsearch 8.19.22, 9.4.8, and 9.5.5 Security Update (ESA-2026-189)

- 種別: advisory
- 関連技術: elasticsearch
- 公開日時: 2026-10-06T18:39:39.000Z
- 情報源: Elastic Security Announcements (https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-189/390862)
- パーマリンク: https://vulnpulse.app/items/elastic-security-6c6e8d026358

Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-based index can submit a specially crafted regular expression that triggers cat…