AZL-112655: CVE-2026-115715 affecting package rubygem-elasticsearch 8.9.0-1
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an affected phonetic encoder of the analysis-phonetic plugin. An authenticated user with permission to write documents to or run searches against an index that uses an affected encoder can cause an Elasticsearch node to exhaust its heap memory. The node can become unresponsive or terminate.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when an Elasticsearch index uses an affected phonetic encoder from the analysis-phonetic plugin. The affected package identified is azure-linux/rubygem-elasticsearch version 8.9.0-1.
What access does an attacker need to trigger the denial of service?
An attacker must be authenticated and have permission to write documents to an affected index or to run searches against one. They must submit a specially crafted input value that is processed by the affected encoder.
What is the operational impact if exploitation succeeds?
The affected Elasticsearch node can exhaust its heap memory. It may become unresponsive or terminate.