Elasticsearch CVE-2026-94397

Requires a valid authenticated Elasticsearch account with at least low-privilege API access (CVSS PR:L) that is network-reachable; no user interaction is needed. Exploitation is limited by that authentication requirement - an unauthenticated remote attacker cannot trigger it. The advisory does not name the specific API endpoint, query construct, or configuration that acts as the allocation sink, so the precise triggering request is unspecified. Impact is confined to availability (denial of service); no data disclosure or integrity impact applies. Mitigation is upgrading to Elasticsearch 8.19.22, 9.4.7, or 9.5.4.

This is a genuine but modest-severity availability issue, not a top-tier priority. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) is internally consistent and I agree with it: network-reachable, low complexity, but requiring low-privilege authentication (PR:L) and yielding availability-only impact (C:N/I:N/A:H) with no scope change. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' All signals converge on a low-to-medium real-world priority: the network vector and low complexity ease access, but the authentication requirement (a valid Elasticsearch account with API access) meaningfully limits the population of attackers, and the impact ceiling is a denial of service rather than data compromise or code execution. From an SSVC lens, technical impact is partial (availability-only) and automatability is plausible (a low-privilege user can script repeated malicious requests), but the lack of any exploitation evidence keeps this in a 'track/patch on normal cadence' tier. The main missing data point is the specific allocation sink - the description generically cites CWE-400 excessive allocation but names no specific API, query type, or feature, so defenders cannot pinpoint the trigger without vendor detail. This CVE is one of a cluster of near-identical Elastic Stack CWE-400 DoS advisories (ESA-2026-181/182/183), suggesting a coordinated hardening pass rather than active exploitation.

An attacker holding a low-privilege but valid Elasticsearch account sends crafted API requests that force the server to allocate an excessive amount of memory or other resources. Repeated or amplified requests exhaust the node's resources, degrading or crashing the cluster and denying service to legitimate users. No public exploit code is identified, and no specific triggering feature is named in the advisory.