EUVD-2026-46395
GHSA-5h86-ph4p-6p7w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable EQL endpoint with low-privilege auth required; pure availability impact via node crash, no confidentiality or integrity loss.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
2DescriptionCVE.org
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL sequence queries against an index they control can send a specially crafted query that triggers excessive memory consumption, causing the Elasticsearch node to crash.
AnalysisAI
Denial of service in Elasticsearch allows a low-privileged authenticated user to crash an Elasticsearch node by submitting a specially crafted EQL sequence query against an index they control, triggering uncontrolled memory consumption (CWE-400, CAPEC-130). Affected across all tracked versions per CPE wildcard, with Elastic releasing fixes in versions 8.19.18, 9.3.7, and 9.4.4 per advisory ESA-2026-57. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad Elasticsearch deployment footprint make this a credible internal threat in multi-tenant or shared cluster environments.
Technical ContextAI
Elasticsearch is a distributed search and analytics engine built on Apache Lucene, widely used for log aggregation, observability pipelines, and full-text search. The vulnerability resides in the Event Query Language (EQL) engine, specifically in how it handles sequence queries - a feature that correlates ordered events across time windows. CWE-400 (Uncontrolled Resource Consumption) indicates that the EQL query parser or executor fails to bound memory allocation when processing adversarial sequence query structures, allowing a crafted input to drive heap consumption beyond safe limits. CAPEC-130 (Excessive Allocation) confirms the attack pattern: the attacker deliberately constructs input that forces the system to over-allocate resources until the process crashes. The affected CPE is cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:* covering all Elasticsearch versions across all platforms.
RemediationAI
The primary remediation is to upgrade Elasticsearch to a patched release. Based on the advisory ESA-2026-57 (https://discuss.elastic.co/t/elasticsearch-8-19-18-9-3-7-9-4-4-security-update-esa-2026-57/388556), upgrade to version 8.19.18 for 8.x deployments, 9.3.7 for 9.3.x deployments, or 9.4.4 for 9.4.x deployments. If immediate patching is not possible, the most targeted compensating control is to audit and restrict EQL sequence query permissions: revoke or scope EQL execution privileges to only trusted users and service accounts via Elasticsearch role-based access control (RBAC), paying particular attention to the run_as privilege and index-level query grants. Additionally, consider disabling the EQL feature entirely on nodes where it is not operationally required, though this may impact observability or SIEM-adjacent workloads depending on your deployment. Rate-limiting or circuit-breaking at the API gateway or load balancer layer for the /_eql/search endpoint can reduce impact but will not prevent a determined authenticated user from eventually triggering the condition. Review the full advisory at the Elastic Discuss link for any additional vendor-recommended mitigations.
More in Elasticsearch
View allDirectory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause
All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. Rated medium severit
Remote code execution in Elasticsearch's machine learning component allows an authenticated user with ML model deploymen
Heap corruption and potential remote code execution in Elasticsearch's native ML inference engine can be triggered by an
The fix for CVE-2020-7009 was found to be incomplete. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker
Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secre
A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Le
The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today