THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-63140 (MEDIUM 6.5) — Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elas

[NVD] CVE-2026-63140 (MEDIUM 6.5) — Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elas

mednvdPublished 2026-07-21

CVE-2026-63140 CVSS: 6.5 MEDIUM Published: 2026-07-21T21:16:53.073

Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats assertion failures as fatal errors,

MITRE ATT&CK techniques

Data ManipulationT1565

Indicators of compromise

CVE-2026-63140cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-63140