Elasticsearch

How Elasticsearch versioning, EOL & security support work

Elasticsearch follows a major.minor.patch scheme. Elastic's Support Services Policy ties "supported" status to whether a version has had a generally available release made for it, deferring the version-by-version timeline to a separate End-of-Life (EOL) policy. Under that policy, each major release's maintenance window is set by comparing two measures, a span from that major's own GA date and a shorter span from the next major's GA date, with whichever produces the longer window applying.

Elastic tracks version-specific risk through its published End-of-Life schedule and a severity-based response framework, patching newly discovered vulnerabilities via Maintenance Releases while a version is still in its window. Running an Elasticsearch version past its End of Life date means new CVEs affecting it are fixed only in versions you're no longer running.

Sources: Elastic Support Policy, Elastic Product End of Life dates

Data sourced from endoflife.date.