What is the CVSS score of CVE-2026-49090?

CVE-2026-49090 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Elasticsearch CVE-2026-49090

EUVD-2026-41100 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-01 elastic

GHSA-xww7-7gcc-rp5w

Elastic Denial Of Service Elasticsearch

6.5

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-accessible _bulk API requires only low-privilege credentials; no confidentiality or integrity impact, full availability loss scoped to the targeted node.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 18:26 vuln.today

DescriptionCVE.org

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk request that causes sustained high CPU consumption, which can render the affected node unable to process requests.

AnalysisAI

Sustained CPU exhaustion in Elasticsearch allows an authenticated low-privilege user to render an affected node unresponsive by submitting a specially crafted bulk request to the _bulk API endpoint. The root cause is CWE-400 (Uncontrolled Resource Consumption), whereby the bulk request processing path fails to bound CPU allocation per request, aligning with CAPEC-130 (Excessive Allocation). No public exploit identified at time of analysis, and no KEV listing exists; however, the low attack complexity and standard network accessibility of the bulk API make this a credible insider or compromised-credential threat in production environments.

Technical ContextAI

Elasticsearch is a distributed search and analytics engine built on Apache Lucene, widely used for log analytics, full-text search, and observability pipelines. The _bulk API endpoint enables high-throughput batch indexing operations and is a core, default-enabled feature in all Elasticsearch deployments. CWE-400 indicates the application does not impose adequate CPU resource limits on the processing of individual bulk request payloads, consistent with CAPEC-130 where an attacker engineers a request that forces disproportionate resource allocation relative to input size or structure. The CPE string cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:* covers all Elasticsearch versions across all platforms. The vendor advisory ESA-2026-52 identifies patched releases at 7.17.24 and 8.15.0, implying all prior releases in the 7.x and 8.x branches are affected.

RemediationAI

Upgrade to Elasticsearch 7.17.24 (for 7.x deployments) or 8.15.0 (for 8.x deployments) as documented in vendor advisory ESA-2026-52 at https://discuss.elastic.co/t/elasticsearch-7-17-24-8-15-0-security-update-esa-2026-52. If immediate patching is not feasible, restrict network access to the _bulk API endpoint to trusted source IPs or service account principals using network-layer ACLs or an API gateway - note this may disrupt legitimate high-throughput ingestion pipelines and requires coordination with application teams. Additionally, enforce strict role-based access control so that only designated ingest service accounts hold the index privilege required for bulk operations, reducing the pool of credentials that could be leveraged. Rate limiting or request payload size caps applied at a reverse proxy layer can constrain the per-request CPU impact, though they may introduce latency for legitimate bulk workloads at scale.