Denial of Service Vulnerability in Elasticsearch by Elastic

CVE-2026-115715

What is CVE-2026-115715?

A vulnerability in Elasticsearch's analysis-phonetic plugin allows an authenticated user to exploit resource allocation issues. By using specially crafted input values, the phonetic encoder can cause an Elasticsearch node to exhaust its heap memory, leading to a denial of service. This can result in the node becoming unresponsive or terminating, impacting the availability of the service for legitimate users.

References