Does anyone have any information on whether version 1.5.2 of Elasticsearch has (or needs) the security fixes from 1.6.1? From the ES blog: Elasticsearch versions prior to 1.6.1 are vulnerable to an engineered attack on its transport protocol (used for communication between nodes and Java clients) that enables remote code execution. This issue is related to the Groovy announcement in CVE-2015-3253. Deployments are vulnerable even when Groovy dynamic scripting is disabled. Users that do not want to upgrade can address the vulnerability by securing the transport protocol port (default9300) to allow access by only trusted agents. -- Elasticsearch versions from 1.0.0 to 1.6.0 are vulnerable to a directory traversal attack that allows an attacker to retrieve files that are readable by the Elasticsearch JVM process. Users that do not wish to upgrade can use a firewall, reverse proxy, or Shield to prevent Snapshot-RestoreAPI calls from untrusted sources. We are using @Floren 's Axivo repository RPM which IIRC is based on 1.5.2 as of this post.