---
id: "CVE-2026-115715"
kind: "vulnerability"
aliases: ["CVE-2026-115715"]
title: "Elasticsearch: crafted phonetic input exhausts heap memory, crashing the node"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["analysis-phonetic", "elasticsearch", "package", "self-hosted"]
not_affected_if: ["no-analysis-phonetic-plugin", "no-phonetic-encoder-in-indexes", "unauthenticated-only-access"]
published_at: "2026-11-03T17:17:56+00:00"
first_seen_at: "2026-11-03T17:21:55+00:00"
updated_at: "2026-11-03T17:24:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115715", "first_seen_at": "2026-11-03T17:21:55+00:00"}]
---

# Elasticsearch: crafted phonetic input exhausts heap memory, crashing the node

A specially crafted input processed by a phonetic encoder in the Elasticsearch analysis-phonetic plugin makes a node run out of heap memory. The node can become unresponsive or terminate, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the `analysis-phonetic` plugin is installed on the cluster node.
- Check whether any index uses a phonetic token filter or encoder from that plugin.
- Confirm the Elasticsearch version in use against the affected range, which the sources do not state: unknown

## Timeline

- 2026-11-03T17:21:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115715

## From the sources

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an affected phonetic encoder of the analysis-phonetic plugin. An authenticated user with permission to write documents to or run searches against an index that uses an affected encoder can cause an Elasticsearch node to exhaust its heap memory. The node can become unresponsive or terminate.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_