CVE-2026-63140

Name of the Vulnerable Software and Affected Versions Elasticsearch (affected versions not specified)

Description An issue exists where a specially crafted search request containing a null value in a specific query clause triggers an internal assertion during query parsing. Since assertion failures are treated as fatal errors, the affected node process terminates. A low-privileged authenticated user with read access to at least one index can exploit this by sending a single request, leading to a denial of service. In single-node deployments, this results in a complete stop of the service, while in multi-node clusters, it reduces overall capacity for each affected node.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.