EUVD-2026-46404
GHSA-g5rr-fgvg-q29h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-accessible authenticated DoS with no data exposure; PR:L reflects required search privileges, A:H reflects potential node and cluster outage.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
2DescriptionCVE.org
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and cluster degradation. An attacker could leverage this vulnerability to cause cluster downtime requiring manual intervention to restore service.
AnalysisAI
Heap exhaustion in Elasticsearch allows authenticated users holding search privileges to crash individual data nodes by submitting specially crafted search requests, degrading or taking down the cluster and requiring manual administrator intervention to restore service. Affected versions span the 8.x and 9.x release lines per vendor advisory ESA-2026-60, with fixes available in 8.19.15, 9.2.9, and 9.3.4 as inferred from the advisory URL. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low authentication barrier makes it a meaningful risk for multi-tenant or shared Elasticsearch deployments.
Technical ContextAI
Elasticsearch is a distributed search and analytics engine built on Apache Lucene and running on the JVM. CWE-400 (Uncontrolled Resource Consumption) via CAPEC-130 (Excessive Allocation) indicates that the search execution path fails to enforce adequate bounds on heap allocation triggered by query evaluation - for example, through deeply nested aggregations, unbounded result windows, or query constructs that cause multiplicative memory expansion per shard. When a data node's JVM heap is exhausted, it enters an OutOfMemoryError state, causing the node to become unresponsive. In a clustered topology, node loss triggers shard reallocation overhead across surviving nodes, potentially cascading into broader cluster degradation. The CPE string cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:* indicates all tracked Elasticsearch versions are captured in scope, though the actual affected range is bounded by the fix releases.
RemediationAI
Upgrade Elasticsearch to version 8.19.15, 9.2.9, or 9.3.4 as indicated by vendor advisory ESA-2026-60, available at https://discuss.elastic.co/t/elasticsearch-8-19-15-9-2-9-9-3-4-security-update-esa-2026-60/388559; these fix versions are inferred from the advisory URL slug and should be confirmed in the advisory body before deployment. If immediate patching is not possible, restrict search privileges to trusted internal users only to reduce the attacker pool - note this may impact external-facing search applications. Additionally, tune Elasticsearch circuit breakers (indices.breaker.total.limit, indices.breaker.request.limit, indices.breaker.fielddata.limit) to cap per-request heap allocation; be aware that aggressive limits may reject legitimate large aggregation queries and should be tested in staging. Rate-limiting search requests per user at the API gateway or load balancer layer can reduce attack throughput as a secondary compensating control.
More in Elasticsearch
View allDirectory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause
All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. Rated medium severit
Remote code execution in Elasticsearch's machine learning component allows an authenticated user with ML model deploymen
Heap corruption and potential remote code execution in Elasticsearch's native ML inference engine can be triggered by an
The fix for CVE-2020-7009 was found to be incomplete. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker
Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secre
A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Le
The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today