EUVD-2026-69558
GHSA-vvr8-mhcc-gx9g
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Network-accessible REST API requires elevated credentials (PR:H); impact is node availability only, with no confidentiality or integrity effects.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
2DescriptionCVE.org
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a specially crafted request that causes excessive memory consumption, which may render the affected node unavailable.
AnalysisAI
Denial of service in Elasticsearch allows an authenticated user with elevated cluster privileges to submit a specially crafted API request that causes unbounded memory consumption, potentially crashing the targeted node and disrupting cluster availability. The flaw is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) with CAPEC-130 attack pattern, and is confirmed by Elastic via advisory ESA-2026-47. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated user account holding elevated cluster privileges on the Elasticsearch instance (PR:H per the vendor-supplied CVSS vector) - accounts with roles such as superuser or equivalent broad query permissions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.9 Medium score is appropriately calibrated: the high-privilege requirement (PR:H) is the dominant risk-limiting factor, restricting the exploitable population to authenticated users holding elevated cluster roles such as superuser. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Elasticsearch to the patched releases documented in advisory ESA-2026-47 at https://discuss.elastic.co/t/elasticsearch-8-19-20-9-3-0-security-update-esa-2026-47/390084; the advisory references fixes in the 8.x and 9.x release lines - consult the advisory directly to confirm exact target versions before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Elasticsearch
View allDirectory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause
All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. Rated medium severit
Remote code execution in Elasticsearch's machine learning component allows an authenticated user with ML model deploymen
Heap corruption and potential remote code execution in Elasticsearch's native ML inference engine can be triggered by an
The fix for CVE-2020-7009 was found to be incomplete. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker
Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secre
A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Le
The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today