EUVD-2026-87800
GHSA-rrx7-wqpq-27hx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege Elasticsearch credentials
-
DeliverySend crafted request over network
-
ExploitTrigger uncontrolled excessive allocation
-
ExecutionExhaust node memory/resources
-
ImpactCluster denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires valid authenticated access to the Elasticsearch cluster (CVSS PR:L), so the attacker must hold at least low-privilege credentials or an API key. Exploitation is remote and low-complexity (AV:N/AC:L) with no user interaction, but the advisory does not name the exact request, query, or feature that triggers the excessive allocation, so defenders cannot pinpoint a specific API to restrict. Impact is limited to availability (denial of service); no data disclosure or modification results. Affected versions are Elasticsearch prior to 9.4.7 and 9.5.4; upgrading to those fixed releases (ESA-2026-182) removes the condition. |
| Impact | This is a moderate-severity availability-only issue, not a top-tier priority. The vendor CVSS 3.1 vector (6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is internally consistent with the CWE-400/CAPEC-130 excessive-allocation DoS description: network-reachable, low complexity, but requiring authentication (PR:L) and yielding availability impact only (no confidentiality or integrity loss). No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation status is 'no public exploit identified at time of analysis.' The single Elastic discuss.elastic.co reference (ESA-2026-182) is a vendor-hosted advisory rather than an independent technical writeup, and it does not name the specific API, query, or feature acting as the allocation sink - a notable gap for defenders. Net: real but bounded risk. The PR:L requirement means an attacker must already hold valid (even low-privilege) Elasticsearch credentials, which sharply limits mass unauthenticated exploitation and makes this more of an insider/compromised-credential or exposed-cluster concern than an internet-wide worm candidate. High raw CVSS driven by A:H should not be mistaken for high real-world urgency absent EPSS/KEV signals. |
| Exploit ScenarioDerived | An attacker holding low-privilege but valid Elasticsearch credentials sends a crafted request that triggers an excessive memory/resource allocation, exhausting node resources and denying service to legitimate users of the cluster. No public proof-of-concept is available, and the specific allocation-triggering operation is not disclosed in the advisory. Because the CVSS vector is AV:N/AC:L, the request can be issued remotely with low complexity once authenticated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Denial of service in Elasticsearch is possible because of uncontrolled resource consumption (CWE-400) that allows an authenticated user to drive excessive allocation and exhaust cluster resources. Elasticsearch deployments prior to 9.4.7 and 9.5.4 are affected; the issue is remote and low-complexity but requires valid low-privilege credentials or an API key (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), and the impact is limited to availability with no data disclosure or modification. There is no public exploit identified at time of analysis and no confirmed active exploitation, and the vendor-scored severity of 6.5 places this as a moderate availability-only issue rather than a top-tier priority.
RemediationAI
Vendor-released patch: upgrade to Elasticsearch 9.4.7 or 9.5.4 as specified in Elastic security update ESA-2026-182 (https://discuss.elastic.co/t/elasticsearch-9-4-7-9-5-4-security-update-esa-2026-182/390686); these are the fixed releases that remove the excessive-allocation condition, and no separate hotfix or workaround is described in the advisory. Until the upgrade can be staged, note that the flaw requires authenticated access (PR:L), so the most effective compensating control is tightening who can reach the cluster: remove unused users and API keys, rotate credentials, and grant least-privilege roles so untrusted tenants cannot issue arbitrary requests, accepting that this restricts legitimate low-privilege integrations until roles are re-scoped. Additionally, enforce rate limiting and request-size caps at the reverse proxy or load balancer in front of Elasticsearch and cap per-node heap and thread pool queues, understanding that aggressive throttling may delay or reject legitimate bulk indexing and heavy search workloads. Enable monitoring and alerting on JVM heap usage, garbage collection, and thread pool rejections so an allocation spike is detected early, and isolate non-production or multi-tenant clusters from sensitive ones to limit blast radius if resource exhaustion occurs. Because POC status is unknown and there is no public exploit identified at time of analysis, prioritization should follow normal patch cadence rather than emergency response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Elasticsearch is a Java-based distributed search and analytics engine whose nodes run on the JVM and manage bounded resources such as heap memory, thread pools, circuit breakers, and per-request memory budgets. The root cause class is CWE-400, Uncontrolled Resource Consumption, mapped to CAPEC-130 (Excessive Allocation): the software fails to adequately bound or throttle the resources a request can consume, so a single well-formed request path can allocate disproportionate memory or threads. In Elasticsearch terms this typically manifests as heap pressure, GC thrashing, queue buildup in search/write thread pools, or rejection of legitimate traffic once limits are reached, escalating to node or cluster unavailability. The CPE cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:* is version-agnostic, and the vendor advisory ESA-2026-182 identifies the corrected builds as 9.4.7 and 9.5.4, meaning all earlier 9.x releases in those lines remain exposed. The advisory does not name the exact request, query, or feature that triggers the excessive allocation, so defenders cannot map the flaw to a single restrictable API and must rely on access control, capacity limits, and monitoring rather than targeted request filtering.
Know when Elasticsearch gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable, low-complexity request requiring authenticated low-privilege access (PR:L), causing availability-only impact with no confidentiality or integrity loss and no scope change.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
DescriptionCVE.org
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Elasticsearch
View allThe Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execut
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause
Maliciously crafted on-chain account names processed by Klever-Go prior to 1.7.20 are spliced into Elasticsearch _bulk r
All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. Rated medium severit
Remote code execution in Elasticsearch's machine learning component allows an authenticated user with ML model deploymen
Heap corruption and potential remote code execution in Elasticsearch's native ML inference engine can be triggered by an
The fix for CVE-2020-7009 was found to be incomplete. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker
Exploit-DB