CVE-2021-22145: A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting.

Security readout for executives and security teams

Elasticsearch versions 7.10.0 through 7.13.3 could leak previously used memory in error messages after a malformed query. That leaked data could include indexed documents or authentication details. The risk is highest where users, applications, or external clients can send arbitrary Elasticsearch queries. Organizations running Elasticsearch 7.10.0 through 7.13.3 are potentially exposed, especially if query access is granted to untrusted users, tenants, applications, or internet-facing services. Prioritize remediation for clusters handling sensitive documents, credentials, or multi-tenant query traffic. This is not listed in KEV, but the possible disclosure of documents or authentication details makes delayed remediation risky. Mitigation focus: Identify Elasticsearch clusters running versions 7.10.0 through 7.13.3.; Follow Elastic guidance from the 7.13.4 security update or later vendor advisories.; Restrict arbitrary query access to trusted users and services only..

Prepared

Jun 2, 2026, 19:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.