EUVD-2026-47591
GHSA-727x-48vv-8cj7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-delivered via HTTP API with low-privilege credentials required; scope unchanged, no confidentiality or integrity impact, only high availability loss.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
2DescriptionCVE.org
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource exhaustion persists beyond query completion, repeated requests can fully exhaust the available query worker resources, rendering ES|QL queries unavailable until the node is restarted.
AnalysisAI
ES|QL engine denial of service in Elasticsearch allows any authenticated network user to trigger exponential CPU consumption by submitting a specially crafted query, exhausting query worker thread pool resources and rendering ES|QL unavailable until the node is manually restarted. Affected versions span two major release trains: Elasticsearch 8.0.0-8.19.18 and the full 9.x series through 9.4.3. No public exploit code has been identified at time of analysis and CISA KEV confirmation is absent; however, Elastic's security team has released patches across all three affected branches (ESA-2026-74).
Technical ContextAI
The vulnerable component is Elasticsearch's ES|QL (Elasticsearch Query Language) engine, a query evaluation subsystem distinct from the traditional Elasticsearch Query DSL. The root cause is CWE-400 (Uncontrolled Resource Consumption) manifesting via the CAPEC-197 (Exponential Data Expansion) attack pattern, where a compact query input triggers computation that grows exponentially in resource cost during evaluation. Critically, the description states that resource exhaustion 'persists beyond query completion,' indicating the defect corrupts or depletes persistent query worker thread pool state rather than being scoped to a single query lifecycle - a node restart is required to recover. Elasticsearch is a Java-based distributed search and analytics engine; the ES|QL subsystem was introduced in the 8.x series and is enabled by default in affected versions. No explicit CPE strings were provided in the available intelligence, but the vulnerable software maps to the Elastic Elasticsearch product family across the 8.x and 9.x release lines.
RemediationAI
Upgrade to Elasticsearch 8.19.19, 9.3.8, or 9.4.4 per the vendor's security advisory ESA-2026-74 at https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-74/388577. For deployments that cannot patch immediately, restrict ES|QL API access via Elasticsearch role-based access control to minimize the set of users authorized to submit ES|QL queries - this reduces but does not eliminate risk for environments requiring broad read access. Implement rate limiting on the ES|QL query endpoint at the proxy or API gateway layer, accepting the trade-off that legitimate high-volume query workloads may be throttled. Monitor Elasticsearch thread pool metrics (particularly the search and esql worker pools) for abnormal CPU saturation as an early detection signal. Note that if a node is already affected, only a full Elasticsearch node restart will restore ES|QL availability - graceful recovery without restart is not available per the vulnerability description.
More in Elasticsearch
View allThe Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execut
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause
All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. Rated medium severit
Remote code execution in Elasticsearch's machine learning component allows an authenticated user with ML model deploymen
Heap corruption and potential remote code execution in Elasticsearch's native ML inference engine can be triggered by an
The fix for CVE-2020-7009 was found to be incomplete. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker
Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secre
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today