CVE-2021-22145

A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details.

• CWE-200
• CWE-209

• http://packetstormsecurity.com/files/163648/ElasticSearch-7.13.3-Memory-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
• https://discuss.elastic.co/t/elasticsearch-7-13-4-security-update/279177Vendor Advisory
• https://gist.github.com/lucasdrufva/f9c5d7c9e26ee087b736d727953afd34
• https://security.netapp.com/advisory/ntap-20210827-0006/Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
• http://packetstormsecurity.com/files/163648/ElasticSearch-7.13.3-Memory-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
• https://discuss.elastic.co/t/elasticsearch-7-13-4-security-update/279177Vendor Advisory
• https://security.netapp.com/advisory/ntap-20210827-0006/Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory

Published

Jul 21, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-2214Vulnerability in the Oracle WebLogic Server product of Oracl…4.4
• CVE-2021-22140Elastic App Search versions after 7.11.0 and before 7.12.0 c…7.5
• CVE-2021-22141An open redirect flaw was found in Kibana versions before 7.…6.1
• CVE-2021-22142Kibana contains an embedded version of the Chromium browser …8.8
• CVE-2021-22143The Elastic APM .NET Agent can leak sensitive HTTP header in…4.3
• CVE-2021-22144In Elasticsearch versions before 7.13.3 and 6.8.17 an uncont…6.5
• CVE-2021-22146All versions of Elastic Cloud Enterprise has the Elasticsear…7.5
• CVE-2021-22147Elasticsearch before 7.14.0 did not apply document and field…6.5
• CVE-2021-22148Elastic Enterprise Search App Search versions before 7.14.0 …8.8
• CVE-2021-22149Elastic Enterprise Search App Search versions before 7.14.0 …8.8
• CVE-2021-2215Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-22150It was discovered that a user with Fleet admin permissions c…7.2