CVE-2021-22144: Elastic Elasticsearch

Medium severity, CVSS 6.5. EPSS: 2.2% chance of exploitation in the next 30 days.

In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.

Affected products

• Elastic Elasticsearch: before 6.8.17 (fixed in 6.8.17); from 7.0.0, before 7.13.3 (fixed in 7.13.3)
• Oracle Communications Cloud Native Core Automated Test Suite: version 1.8.0 only

Published 2021-07-26. Last modified 2026-06-17.