{"id":"CVE-2026-115715","kind":"vulnerability","aliases":["CVE-2026-115715"],"related":[],"title":"Elasticsearch: crafted phonetic input exhausts heap memory, crashing the node","description":"Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an affected phonetic encoder of the analysis-phonetic plugin. An authenticated user with permission to write documents to or run searches against an index that uses an affected encoder can cause an Elasticsearch node to exhaust its heap memory. The node can become unresponsive or terminate.","summary":"A specially crafted input processed by a phonetic encoder in the Elasticsearch analysis-phonetic plugin makes a node run out of heap memory. The node can become unresponsive or terminate, causing denial of service.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["analysis-phonetic","elasticsearch","package","self-hosted"],"not_affected_if":["no-analysis-phonetic-plugin","no-phonetic-encoder-in-indexes","unauthenticated-only-access"],"how_to_check":"- Check whether the `analysis-phonetic` plugin is installed on the cluster node.\n- Check whether any index uses a phonetic token filter or encoder from that plugin.\n- Confirm the Elasticsearch version in use against the affected range, which the sources do not state: unknown","fix":null,"status":"open","published_at":"2026-11-03T17:17:56+00:00","first_seen_at":"2026-11-03T17:21:55+00:00","triaged_at":"2026-11-03T17:24:15+00:00","updated_at":"2026-11-03T17:24:15+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T17:24:15Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Elasticsearch: crafted phonetic input exhausts heap memory, crashing the node","impact":"medium","summary":"A specially crafted input processed by a phonetic encoder in the Elasticsearch analysis-phonetic plugin makes a node run out of heap memory. The node can become unresponsive or terminate, causing denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["elasticsearch","analysis-phonetic","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Elasticsearch node exhausts heap and becomes unresponsive or terminates","analyst_note":"Sources give no affected or fixed Elasticsearch versions and no list of affected encoders; check the NVD entry and the Elastic advisory for those.","how_to_check":"- Check whether the `analysis-phonetic` plugin is installed on the cluster node.\n- Check whether any index uses a phonetic token filter or encoder from that plugin.\n- Confirm the Elasticsearch version in use against the affected range, which the sources do not state: unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-analysis-phonetic-plugin","no-phonetic-encoder-in-indexes","unauthenticated-only-access"],"who_is_affected":"Only clusters that run the analysis-phonetic plugin and have indexes using an affected phonetic encoder are exposed. The attacker must be an authenticated user who can write documents to or run searches against such an index. Clusters without the plugin or without those encoders can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000722,"input_tokens":4178,"output_tokens":608,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115715':13A,16A '-2026':12A,15A '-770':68C 'affect':88C,115C 'alloc':60C 'analysi':18B,38B,94C 'analysis-phonet':17B,37B,93C 'authent':98C 'becom':52B,130C 'caus':56B,118C 'craft':2A,27B,80C 'crash':8A 'cve':11A,14A 'cwe':67C 'denial':57B,74C 'document':104C 'elasticsearch':1A,20B,36B,70C,120C 'encod':33B,90C,116C 'exhaust':5A,123C 'heap':6A,47B,125C 'host':24B 'index':111C 'input':4A,28B,81C 'lead':72C 'limit':64C 'make':41B 'memori':7A,48B,126C 'node':10A,43B,50B,121C,128C 'packag':21B 'permiss':101C 'phonet':3A,19B,32B,39B,89C,95C 'plugin':40B,96C 'process':29B,85C 'resourc':62C 'run':44B,107C 'search':108C 'self':23B 'self-host':22B 'servic':59B,76C 'special':26B,79C 'termin':55B,133C 'throttl':66C 'unrespons':53B,131C 'use':113C 'user':99C 'valu':82C 'via':77C 'without':63C 'write':103C","nicknames":[],"mitigations":[],"who_affected":"Only clusters that run the analysis-phonetic plugin and have indexes using an affected phonetic encoder are exposed. The attacker must be an authenticated user who can write documents to or run searches against such an index. Clusters without the plugin or without those encoders can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["analysisphonetic","elasticsearch","medium","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-03T17:17:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security@elastic.co","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115715","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115715","severity":null,"published_at":"2026-11-03T17:17:56+00:00","modified_at":"2026-11-03T17:17:56+00:00","first_seen_at":"2026-11-03T17:21:55+00:00","fetched_at":"2026-11-03T17:21:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}