Assertion Vulnerability in Elasticsearch by Elastic

CVE-2026-63140

What is CVE-2026-63140?

A reachable assertion in Elasticsearch allows low-privileged authenticated users to manipulate input data, resulting in denial of service. By sending a specially crafted search request with a null value in a specific query clause, an attacker can trigger an internal assertion failure during query parsing. This fatal error leads to the termination of the affected node process, interrupting search functionalities. In single-node deployments, Elasticsearch is completely halted, while multi-node clusters experience reduced capacity for each impacted node.

References