CVE-2026-115715

MediumCVSS 6.5/10Last modified Nov 3, 2026

Description

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an affected phonetic encoder of the analysis-phonetic plugin. An authenticated user with permission to write documents to or run searches against an index that uses an affected encoder can cause an Elasticsearch node to exhaust its heap memory. The node can become unresponsive or terminate.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
ElasticElasticsearch>= 8.0.0, <= 8.19.23; >= 9.0.0, <= 9.4.8; >= 9.5.0, <= 9.5.5

References

Timeline

Published
Nov 3, 2026
Last modified
Nov 3, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1157166.5Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data PayCVE-2026-1157177.7Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks tCVE-2026-1157184.3Frappe Builder versions 1.33.0 before 1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any auCVE-2026-115728.8Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of CVE-2026-1157205.0Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assert_not_private_url() guardCVE-2026-1157217.5**UNSUPPORTED WHEN ASSIGNED**  Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. CVE-2026-1157226.1RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list propeCVE-2026-1157237.4Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow CVE-2026-1157242.9VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based onCVE-2026-1157254.2Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplCVE-2026-1157267.8Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aiderCVE-2026-1157278.1AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while