CVE-2026-0543
- Source
- https://cve.org/CVERecord?id=CVE-2026-0543
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-0543.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-0543
- Aliases
- Published
- 2026-01-13T21:15:51.170Z
- Modified
- 2026-02-11T13:51:01.348074Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (CAPEC-130) through a specially crafted email address parameter. This requires an attacker to have authenticated access with view-level privileges sufficient to execute connector actions. The application attempts to process specially crafted email format, resulting in complete service unavailability for all users until manual restart is performed.
- References
Affected packages
Git / github.com/elastic/elasticsearch
Database specific
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-0543.json"
vanir_signatures
[
{
"target": {
"file": "x-pack/plugin/esql/qa/server/multi-clusters/src/javaRestTest/java/org/elasticsearch/xpack/esql/ccq/MultiClustersIT.java"
},
"digest": {
"line_hashes": [
"339989005070293948889933501940142597303",
"13293225995778884427988026716579835726",
"285473138124210792382754202203247273452",
"149440144382033757905868782046995876512",
"64197332674087243924799585325821921624",
"220125452328405385455220263521782368772",
"44054000405676329580365847187748177142",
"117864023219185431450705863805781940292",
"26695265451208233345587671194620767861",
"32685701549309508470954705926679877435",
"83862061399325907657626858430272539782",
"12242924357397252566221994009693583805",
"8136595536233847186083646248296810780",
"165295507730832872211574762763104555722",
"217127676271723886021598934126785761194",
"208750635732957528035067914485373430241",
"45871670946231663159093600629024600678",
"57282404469934620552327770150644283328",
"117043655475253651245516425517502151642",
"123378332383219560903029304598780519404",
"208774845280621349658646399321880289635"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2026-0543-0734a63a",
"source": "https://github.com/elastic/elasticsearch/commit/93788a8c2882eb5b606510680fac214cff1c7a22",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/scalar/spatial/StDistance.java",
"function": "fold"
},
"digest": {
"length": 244.0,
"function_hash": "278167882145718049942096491203140322678"
},
"signature_type": "Function",
"id": "CVE-2026-0543-15be47a0",
"source": "https://github.com/elastic/elasticsearch/commit/dfc5c38614c29a598e132c035b66160d3d350894",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/scalar/spatial/SpatialIntersects.java",
"function": "foldGeoGrid"
},
"digest": {
"length": 215.0,
"function_hash": "311014547387809437110548933350288972876"
},
"signature_type": "Function",
"id": "CVE-2026-0543-2ec69dbb",
"source": "https://github.com/elastic/elasticsearch/commit/dfc5c38614c29a598e132c035b66160d3d350894",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/action/EsqlCapabilities.java"
},
"digest": {
"line_hashes": [
"89445801202175325502738843967730067249",
"192039372488636267956404281949205265392",
"32429896819276073679516153726001938810"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2026-0543-30bc7877",
"source": "https://github.com/elastic/elasticsearch/commit/dfc5c38614c29a598e132c035b66160d3d350894",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/scalar/spatial/SpatialRelatesUtils.java",
"function": "makeGeometryFromLiteralValue"
},
"digest": {
"length": 517.0,
"function_hash": "254564567077244775693349926773822670932"
},
"signature_type": "Function",
"id": "CVE-2026-0543-32f07d31",
"source": "https://github.com/elastic/elasticsearch/commit/dfc5c38614c29a598e132c035b66160d3d350894",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/action/EsqlCapabilities.java"
},
"digest": {
"line_hashes": [
"50263812206979476680582593266846575414",
"106482157789885345613495692210463876225",
"198849732507623910852044338742121187654",
"202171664757203933883271978000549082331"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2026-0543-3cc5296b",
"source": "https://github.com/elastic/elasticsearch/commit/93788a8c2882eb5b606510680fac214cff1c7a22",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/scalar/spatial/SpatialRelatesUtils.java",
"function": "asLuceneComponent2Ds"
},
"digest": {
"length": 330.0,
"function_hash": "152274576639623713355926308042475482684"
},
"signature_type": "Function",
"id": "CVE-2026-0543-429b3b83",
"source": "https://github.com/elastic/elasticsearch/commit/dfc5c38614c29a598e132c035b66160d3d350894",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/scalar/spatial/SpatialContains.java"
},
"digest": {
"line_hashes": [
"289908624833291486394602649608945724777",
"182982455196979132601858365173822822733",
"113275466473144888852821617702148810203",
"232596456196954803630152947089961650661",
"172010652497322196176388420336492678967",
"333093167882707278206269849978879791958",
"107593237170993648987366503789174562535",
"158639637653948292192156723532982140970",
"320518281967884674260888170876056181231",
"308066354449496495932780769843307431410",
"59638868088854487319798954918275630978",
"257313696561606941788102017595516892785",
"252950549000890750165334822116866577968",
"25584037567455179930587038186226659627",
"247727639331087797681175124487032759759",
"212381941043612365152527091184086593507"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2026-0543-476fd054",
"source": "https://github.com/elastic/elasticsearch/commit/dfc5c38614c29a598e132c035b66160d3d350894",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/scalar/spatial/SpatialContains.java",
"function": "fold"
},
"digest": {
"length": 428.0,
"function_hash": "159882098396121362013834072495403138773"
},
"signature_type": "Function",
"id": "CVE-2026-0543-5493f5fb",
"source": "https://github.com/elastic/elasticsearch/commit/dfc5c38614c29a598e132c035b66160d3d350894",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/scalar/spatial/SpatialIntersects.java"
},
"digest": {
"line_hashes": [
"159938584584814269812543824147788630694",
"143110200356496714021711330139444543498",
"81887352030714866154540202490724441707",
"52178537418449307904647133624897082463",
"244967273296151303242271194171202848668",
"259186396962059732710868935235549715372",
"328206604528049200914116295225183679618",
"186681308239638010316053364162442532414",
"222072532793014277540286489597378030686",
"160372123964887173666455588107404962840",
"309590420312847613445567834741805261785",
"321318697051798583276021409099369823566",
"162986565513426105783344080323858877579",
"156633525707808038414998470097071484516",
"107593237170993648987366503789174562535",
"142268023816213317712585340018420523158",
"34723623823228436863398487562378345072",
"286937004675321860303631726674952210681",
"332322607114068418715836460261357531931",
"25917120446254299741977760892606889887",
"195896218038627048772537545063185857690",
"79921938797154838838273988892745678432",
"9174842457029120972308439321794560998",
"210728420247665831362676487223023924863",
"167488062694071070512678292117466350779",
"122766229661884259171871029299979425221",
"107968378746460121059333452221558981867",
"167790967253397391148381246073235392333",
"286080849013434433443996633774646901494",
"261374999214591200845154318542724628883",
"171655665526437303387703693081957797340",
"251622944399437509025106012302033430325",
"3467085415612652550639979590159518007",
"120481717539309231246920891692751182654",
"305386927234164310588516403206895891376"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2026-0543-5811b0ba",
"source": "https://github.com/elastic/elasticsearch/commit/dfc5c38614c29a598e132c035b66160d3d350894",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/qa/server/multi-clusters/src/javaRestTest/java/org/elasticsearch/xpack/esql/ccq/MultiClustersIT.java",
"function": "assertClusterDetailsMap"
},
"digest": {
"length": 2430.0,
"function_hash": "141438288288405377223387303222608055850"
},
"signature_type": "Function",
"id": "CVE-2026-0543-5c6e1d84",
"source": "https://github.com/elastic/elasticsearch/commit/93788a8c2882eb5b606510680fac214cff1c7a22",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/scalar/spatial/SpatialWithin.java"
},
"digest": {
"line_hashes": [
"159938584584814269812543824147788630694",
"143110200356496714021711330139444543498",
"81887352030714866154540202490724441707",
"52178537418449307904647133624897082463",
"244967273296151303242271194171202848668",
"259186396962059732710868935235549715372",
"332449505004726875131052391309198798245",
"100534791926322759627017705220079706938",
"139038619100505269137749935041499362430",
"317283197747076068523168770339515968281",
"11160651009169442642210369679935003384",
"308558021187776622897119460695003996086",
"107593237170993648987366503789174562535",
"158639637653948292192156723532982140970",
"195388415890610986362676117611441755329",
"36857685711674485203407194260084203897",
"210728420247665831362676487223023924863",
"167488062694071070512678292117466350779",
"122766229661884259171871029299979425221",
"107968378746460121059333452221558981867",
"167790967253397391148381246073235392333",
"286080849013434433443996633774646901494",
"240261223833770194560952454897867749991",
"222708066572920169778959658276263396234"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2026-0543-5f6d3352",
"source": "https://github.com/elastic/elasticsearch/commit/dfc5c38614c29a598e132c035b66160d3d350894",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/internalClusterTest/java/org/elasticsearch/xpack/esql/action/CrossClusterQueryWithFiltersIT.java",
"function": "assertClusterMetadataSuccess"
},
"digest": {
"length": 302.0,
"function_hash": "90798712844445418630971956751252175696"
},
"signature_type": "Function",
"id": "CVE-2026-0543-5f8cc8ba",
"source": "https://github.com/elastic/elasticsearch/commit/93788a8c2882eb5b606510680fac214cff1c7a22",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/plugin/DataNodeRequestSender.java",
"function": "startComputeOnDataNodes"
},
"digest": {
"length": 729.0,
"function_hash": "85359031855638273640871805883878705850"
},
"signature_type": "Function",
"id": "CVE-2026-0543-64d8a123",
"source": "https://github.com/elastic/elasticsearch/commit/93788a8c2882eb5b606510680fac214cff1c7a22",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/plugin/DataNodeRequestSender.java"
},
"digest": {
"line_hashes": [
"271446784469494417830087860337131594973",
"90105849004642149648503457060938569419",
"73747600875301811305035084295715087939",
"52230509336368883283621863227366939965",
"144055432704072120585597575653891225114",
"122501901906308814929988083148211161801",
"173049965005568849954340290988995108800",
"283334812912926491574863258574685678801",
"87295544757969091997901738907585440735",
"25890608579617378032484291965416075085",
"310365956981997553455961605423109907459",
"99741157311725857359712267006514688088",
"180219853309211758845946815455047664907",
"241329324410295599829827744322178852285"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2026-0543-711f6737",
"source": "https://github.com/elastic/elasticsearch/commit/93788a8c2882eb5b606510680fac214cff1c7a22",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/scalar/spatial/SpatialRelatesUtils.java",
"function": "asGeometryDocValueReader"
},
"digest": {
"length": 386.0,
"function_hash": "144794844672963001641414990553528666975"
},
"signature_type": "Function",
"id": "CVE-2026-0543-926e3d86",
"source": "https://github.com/elastic/elasticsearch/commit/dfc5c38614c29a598e132c035b66160d3d350894",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/scalar/spatial/SpatialDisjoint.java",
"function": "foldGeoGrid"
},
"digest": {
"length": 215.0,
"function_hash": "311014547387809437110548933350288972876"
},
"signature_type": "Function",
"id": "CVE-2026-0543-a5b7acd2",
"source": "https://github.com/elastic/elasticsearch/commit/dfc5c38614c29a598e132c035b66160d3d350894",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/scalar/spatial/SpatialIntersects.java",
"function": "fold"
},
"digest": {
"length": 704.0,
"function_hash": "173481735762422087009412637049114840178"
},
"signature_type": "Function",
"id": "CVE-2026-0543-a6217ad2",
"source": "https://github.com/elastic/elasticsearch/commit/dfc5c38614c29a598e132c035b66160d3d350894",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/scalar/spatial/SpatialRelatesUtils.java",
"function": "asLuceneComponent2D"
},
"digest": {
"length": 310.0,
"function_hash": "48950865824045045923768628888741655320"
},
"signature_type": "Function",
"id": "CVE-2026-0543-afae4b7d",
"source": "https://github.com/elastic/elasticsearch/commit/dfc5c38614c29a598e132c035b66160d3d350894",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/internalClusterTest/java/org/elasticsearch/xpack/esql/action/CrossClusterQueryWithFiltersIT.java",
"function": "assertClusterMetadataSkippedShards"
},
"digest": {
"length": 306.0,
"function_hash": "195334585609076384857507106956168439399"
},
"signature_type": "Function",
"id": "CVE-2026-0543-be27c48c",
"source": "https://github.com/elastic/elasticsearch/commit/93788a8c2882eb5b606510680fac214cff1c7a22",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/scalar/spatial/SpatialDisjoint.java"
},
"digest": {
"line_hashes": [
"159938584584814269812543824147788630694",
"143110200356496714021711330139444543498",
"81887352030714866154540202490724441707",
"52178537418449307904647133624897082463",
"244967273296151303242271194171202848668",
"259186396962059732710868935235549715372",
"328206604528049200914116295225183679618",
"186681308239638010316053364162442532414",
"222072532793014277540286489597378030686",
"160372123964887173666455588107404962840",
"294318522468788907779901659896812697273",
"61776288086765959844413420161156660555",
"231622719012071133769233912168819964790",
"234226274597108848761626425582553266989",
"107593237170993648987366503789174562535",
"142268023816213317712585340018420523158",
"34723623823228436863398487562378345072",
"286937004675321860303631726674952210681",
"332322607114068418715836460261357531931",
"25917120446254299741977760892606889887",
"195896218038627048772537545063185857690",
"79921938797154838838273988892745678432",
"9174842457029120972308439321794560998",
"210728420247665831362676487223023924863",
"167488062694071070512678292117466350779",
"122766229661884259171871029299979425221",
"107968378746460121059333452221558981867",
"167790967253397391148381246073235392333",
"286080849013434433443996633774646901494",
"261374999214591200845154318542724628883",
"171655665526437303387703693081957797340",
"251622944399437509025106012302033430325",
"3467085415612652550639979590159518007",
"120481717539309231246920891692751182654",
"305386927234164310588516403206895891376"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2026-0543-c92e3b1e",
"source": "https://github.com/elastic/elasticsearch/commit/dfc5c38614c29a598e132c035b66160d3d350894",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/scalar/spatial/SpatialWithin.java",
"function": "fold"
},
"digest": {
"length": 397.0,
"function_hash": "326133954559011318969718707268870334969"
},
"signature_type": "Function",
"id": "CVE-2026-0543-cbbd2dba",
"source": "https://github.com/elastic/elasticsearch/commit/dfc5c38614c29a598e132c035b66160d3d350894",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/scalar/spatial/BinarySpatialFunction.java"
},
"digest": {
"line_hashes": [
"212005643762940819479152720089909839593",
"98132781130729259383633732127449641649",
"112692759347885544922991393791772594099",
"39727865364976163866822374595628810846",
"331673045678489387772777413600988679405",
"107713692413310480839763589421931946880",
"11402369503442891516471610581519168694",
"46288656724656729497436228900416938347",
"31625664630529446865965699865561504527",
"48987433020626652959425120381739172414",
"251200072850509167383075967730754450615",
"310472225133145836774580493563202575947",
"102042172792708064914895858504438679508",
"226739799159435422410410256622685923156",
"161565216367936501933943135847389720341",
"314535726435643681945163040695224827975",
"178039324672359300277518207498824601910",
"128497629522253437256595106105466532997",
"263997749384745038718994099605848982394",
"27235139341067072411491844337935239121",
"153781465205251298212755693690227746609",
"28920510398153752562178853731748539288"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2026-0543-d0b0c01c",
"source": "https://github.com/elastic/elasticsearch/commit/dfc5c38614c29a598e132c035b66160d3d350894",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/scalar/spatial/StDistance.java"
},
"digest": {
"line_hashes": [
"273501711828316748765212740871437214055",
"21906773089885319547745233488798258231",
"244967273296151303242271194171202848668",
"259186396962059732710868935235549715372",
"171102295323267895517753208948375051630",
"247432046697029015804975974554718206434",
"215464165889090356303057440335870974069",
"308444351408490647764882565003741092259",
"104537635278078599117134923208817953894",
"248377113421987225636045537275314382254"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2026-0543-d9931932",
"source": "https://github.com/elastic/elasticsearch/commit/dfc5c38614c29a598e132c035b66160d3d350894",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/scalar/spatial/SpatialRelatesUtils.java"
},
"digest": {
"line_hashes": [
"38606939774861271662348099041867697139",
"87952923863787264797523626985785477895",
"226528087147752931958870052810432943173",
"120843645902758838681273990887846087866",
"267175423646558406571187739535601307322",
"256417156206752032966833411289024589544",
"18067378875997226204376071184267016799",
"243675825527536951187645836504106074420",
"97122747342907763840661732133001898159",
"145635565430924610562494991402217137723",
"205872590019232641150066773679194891608",
"322535596472542320226330008421454041726",
"266975700825147177977031531115423145257",
"159226662257523133067825921788622807783",
"111970572951652597405249962375490779471",
"221446301059801561712396960554938826792"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2026-0543-db4f8ed0",
"source": "https://github.com/elastic/elasticsearch/commit/dfc5c38614c29a598e132c035b66160d3d350894",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/scalar/spatial/SpatialDisjoint.java",
"function": "fold"
},
"digest": {
"length": 704.0,
"function_hash": "173481735762422087009412637049114840178"
},
"signature_type": "Function",
"id": "CVE-2026-0543-ddcdafcb",
"source": "https://github.com/elastic/elasticsearch/commit/dfc5c38614c29a598e132c035b66160d3d350894",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/internalClusterTest/java/org/elasticsearch/xpack/esql/action/CrossClusterQueryWithFiltersIT.java"
},
"digest": {
"line_hashes": [
"22382789716408460750299756781896027298",
"114994423470006021076942906064469125787",
"149626998340728020934176131559208807182",
"63582442871168261355000682279462188873",
"59377736044725797224522890859900139658",
"29923174501338432596201977531399531101",
"290305842765385716525321109006925272410",
"245682585690779973806582622474193205991",
"339676141314518123357519832238265943016"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2026-0543-de061e7c",
"source": "https://github.com/elastic/elasticsearch/commit/93788a8c2882eb5b606510680fac214cff1c7a22",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/expression/function/scalar/spatial/SpatialRelatesFunction.java"
},
"digest": {
"line_hashes": [
"132987015820349844418094882577382691273",
"315975170795317379009017322126581601274",
"253527113401111806502529251158794993876",
"223788680151301375816883521600797932138",
"143688880268304979884947818371227706977",
"157001732430726903776219345449058442931",
"121158084312246201272588175974300618184",
"210576436712993427822596808735593374039",
"51462449986861376566976535804491286564",
"256633369140543351817861863396062899122",
"319883457680418667495202832565810368545",
"263507797271876387474053910029326846514",
"193112933182339323244338340440578190865"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2026-0543-e13bc4e8",
"source": "https://github.com/elastic/elasticsearch/commit/dfc5c38614c29a598e132c035b66160d3d350894",
"deprecated": false,
"signature_version": "v1"
}
]