EUVD-2026-87797
GHSA-8j5h-hqqm-4pfr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege Elasticsearch credentials
-
DeliverySend crafted request triggering excessive allocation
-
ExploitUncontrolled resource consumption (CWE-400)
-
ExecutionNode/cluster memory exhaustion
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network access to an Elasticsearch node plus at least low-privilege authentication (PR:L) - a valid user account, API key, or service token - so it is not exploitable by fully unauthenticated attackers against a properly secured cluster. No user interaction is needed (UI:N). Impact is limited to availability (memory/resource exhaustion causing node or cluster DoS); there is no confidentiality or integrity impact. Exposure is worst for clusters that grant broad or self-service API access to many users or that expose authenticated endpoints to untrusted networks. Fixed in Elasticsearch 8.19.22, 9.4.7, and 9.5.4 (ESA-2026-179). |
| Impact | This is a moderate-risk, authenticated denial-of-service issue rather than a top-tier priority. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) is internally consistent: network-reachable, low complexity, but requiring at least low-privilege authentication (PR:L), with impact limited purely to availability (A:H) and no confidentiality or integrity loss. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis.' The absence of KEV/EPSS/POC combined with the authentication requirement (PR:L) means this is unlikely to see mass opportunistic exploitation; the realistic threat is an authenticated user (or compromised/leaked API credential) triggering excessive memory/resource allocation to crash or degrade a cluster. The only reference is the vendor's own ESA-2026-179 advisory (discuss.elastic.co), which confirms the affected product and fix but was not independently corroborated by NVD enrichment in the provided data. Net: a real but bounded operational-availability risk, not a high-urgency RCE/data-exposure event. |
| Exploit ScenarioDerived | An authenticated but low-privilege user (or an attacker holding a stolen API key/service token) sends a crafted request to an Elasticsearch endpoint that triggers uncontrolled/excessive memory allocation (CAPEC-130). The resulting resource exhaustion degrades or crashes the node, causing a denial of service for the cluster. No public exploit code was identified in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Authenticated denial of service in Elasticsearch allows a remote attacker holding only low-privilege credentials to drive uncontrolled resource consumption, exhausting node memory and degrading or halting cluster availability (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Impact is confined to availability - there is no confidentiality or integrity loss - and exploitation requires a valid account, API key, or service token, so fully unauthenticated attackers cannot trigger it against a properly secured cluster. No public exploit code or confirmed active exploitation has been identified at time of analysis, and vendor fixes are available in Elasticsearch 8.19.22, 9.4.7, and 9.5.4 (ESA-2026-179).
RemediationAI
Upgrade to Elasticsearch 8.19.22, 9.4.7, or 9.5.4 per vendor advisory ESA-2026-179 (https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-179/390683); these are vendor-released fixed versions and the only complete remedy. Until patching is possible, reduce the attack surface by restricting which principals can reach the API - revoke or scope down broad self-service account permissions and API keys so that only trusted, purpose-built roles can issue resource-intensive requests, accepting the operational cost that legitimate power users lose some flexibility. Keep Elasticsearch REST and transport ports off untrusted networks via firewall rules or a reverse proxy that enforces rate limiting and request-size caps, understanding that aggressive rate limits can drop legitimate bulk and search traffic. Monitor JVM heap usage, circuit-breaker trip metrics, and node-level out-of-memory restarts as detection signals for this class of abuse, and validate that configured heap and circuit-breaker settings remain within vendor-recommended bounds.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-400 (Uncontrolled Resource Consumption) realized through CAPEC-130 (Excessive Allocation): Elasticsearch, a Java-based distributed search and analytics engine built on a JVM heap, accepts API requests that can request or retain far more memory than the node's resource guards permit. Because the internal circuit breakers and JVM heap accounting are the primary defense against memory pressure, a request or sequence of requests that slips past those limits can force the node into sustained heap pressure, long garbage-collection pauses, or out-of-memory termination - failures that propagate across a cluster as shard reallocation and request timeouts. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms the endpoint is network-reachable, requires low privileges (PR:L, i.e. a valid user, API key, or service token), needs no user interaction, and yields a high availability-only impact with unchanged scope. The CPE attribution cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:* applies the issue to the Elasticsearch product line as a whole, with fixes scoped to the 8.19.22, 9.4.7, and 9.5.4 maintenance releases rather than to a single component.
Know when Elasticsearch gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable with low complexity but needs authenticated access (PR:L); impact is availability-only (A:H) with no confidentiality or integrity effect, matching a CWE-400 excessive-allocation DoS.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
DescriptionCVE.org
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Elasticsearch
View allThe Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execut
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause
Maliciously crafted on-chain account names processed by Klever-Go prior to 1.7.20 are spliced into Elasticsearch _bulk r
All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. Rated medium severit
Remote code execution in Elasticsearch's machine learning component allows an authenticated user with ML model deploymen
Heap corruption and potential remote code execution in Elasticsearch's native ML inference engine can be triggered by an
The fix for CVE-2020-7009 was found to be incomplete. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker
Exploit-DB