Database
Elasticsearch: supported versions and open vulnerabilities today
Elasticsearch 9.5, 9.4 and 8.19 are supported; 9.3 reached end of life on Aug 4, 2026; the latest release is 9.5.5. No advisories for Elasticsearch were published in the last 12 months; 2 advisories (CVE-2014-3120, CVE-2015-1427) are on CISA’s list of vulnerabilities exploited in the wild.
Last checked against endoflife.date, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.
- Latest release
- 9.5.5
- GitHub stars
- 78.3k
- OpenSSF Scorecard
- 6.7 / 10
Supported versions
Security advisories
No advisories published in the last 12 months. 40 in total since records began. Checked packages: org.elasticsearch:elasticsearch.
Older advisories CISA lists as exploited in the wild
- CVE-2014-3120 added ; fixed in 1.4.0.Beta1.
- CVE-2015-1427 added ; fixed in 1.3.8 and 1.4.3.
Licence
Elasticsearch is not Apache-licensed since 7.11 (Elastic License 2.0 / SSPL)
Elastic left Apache 2.0 in 2021; the default distribution is under the Elastic License 2.0, which forbids offering Elasticsearch as a managed service. AGPLv3 was added as a source-code option in 2024.
Maintenance and supply chain
OpenSSF Scorecard 6.7 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 30 issue updates found in the last 90 days.
Weakest checks
- No static analysis (SAST 0/10)
- No fuzzing (Fuzzing 0/10)
- No OpenSSF best-practices badge (CII-Best-Practices 0/10)
Production checklist
Elasticsearch production checklist: 5 checks before launch
- Must do: Keep security enabled: authentication and TLS
- Should do: Schedule snapshots to object storage
- Should do: Keep port 9200 on a private network
Alternatives
Algolia
Managed search and discovery API
Strengths
- Blazing fast search (<10ms)
- Easy to implement
Trade-offs
- Vendor lock-in
- Limited customization
Typesense
Open-source alternative to Algolia
Strengths
- Fast search performance
- Easy to set up
Trade-offs
- Smaller ecosystem
- Fewer advanced features
Meilisearch
Lightning-fast open-source search engine
Strengths
- Sub-millisecond search responses
- Out-of-the-box typo tolerance
Trade-offs
- Less feature-rich than Elasticsearch
- Single-node deployment (no clustering)
OpenSearch
Community-driven fork of Elasticsearch
Strengths
- Fully open-source (Apache 2.0 license)
- Elasticsearch-compatible (easy migration)
Trade-offs
- Smaller ecosystem than Elasticsearch
- Some divergence from Elasticsearch features
Docs and release notes
Check Elasticsearch in your own stack
This page checks Elasticsearch in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.