TI-2021-05135 Aliases CVE-2021-22145 GHSA-q394-h7f5-7f44

Information disclosure in Elasticsearch

HIGH 68CWE-200Published 2021-07-21 · Updated 2025-07-08

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details.

Why it matters now

EPSS 0.76249 99th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed org.elasticsearch.client:elasticsearch-rest-client (Maven): 7.13.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Elastic	Elasticsearch	7.10.0 – 7.13.3	—	No fix listed	CNA
—	org.elasticsearch.client:elasticsearch-rest-client (Maven)	7.10.0 to before 7.13.4	7.13.4	Patch available	GHSA-q394-h7f5-7f44

Elasticsearch VendorElastic Affected 7.10.0 – 7.13.3 Fixed in — No fix listed CNA
org.elasticsearch.client:elasticsearch-rest-client (Maven) Vendor— Affected 7.10.0 to before 7.13.4 Fixed in 7.13.4 Patch available GHSA-q394-h7f5-7f44

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:elastic:elasticsearch::::::::	7.10.0 – 7.13.3	Vulnerable	Elastic
cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.8.0:::::::*	1.8.0	Vulnerable	Oracle

cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:* Versions 7.10.0 – 7.13.3 Vulnerable ·Elastic
cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·Oracle

Remediation

Fix · GHSA-q394-h7f5-7f44 org.elasticsearch.client:elasticsearch-rest-client (Maven) Fixed in 7.13.4 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 14 products

Logging Subsystem for Red Hat OpenShift
OpenShift Service Mesh 1
OpenShift Service Mesh 2.0
Red Hat Decision Manager 7
Red Hat Fuse 7
Red Hat Integration Camel K 1
Red Hat JBoss Data Grid 6
Red Hat JBoss Fuse 6
Red Hat JBoss Fuse Service Works 6
Red Hat OpenShift Container Platform 3.11
Red Hat OpenShift Container Platform 4
Red Hat OpenStack Platform 10 (Newton)
Red Hat Process Automation 7
Red Hat Quay 3

Timeline

2026-10-02 Threatist record created from CVE-2021-22145
2026-10-03 Alias added: GHSA-q394-h7f5-7f44

References

Exploit 1

http://packetstormsecurity.com/files/163648/ElasticSearch-7.13.3-Memory-Disclosure.html

Patch 1

https://www.oracle.com/security-alerts/cpuapr2022.html

Advisory 3

Other 3

TI-2015-01295 The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows… KEVCVSS 3.1CRITICAL 9.8
TI-2014-02491 The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which… KEVCVSS 3.1HIGH 8.1
TI-2023-15037 Elasticsearch StackOverflow vulnerability CVSS 3.1HIGH 7.5
TI-2021-05136 All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled… CVSS 3.1HIGH 7.5
TI-2015-04530 Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via… CVSS 3.0CRITICAL 9.8
TI-2022-07764 Improper check for unusual conditions in elasticsearch CVSS 3.1HIGH 7.5

See all 90 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences