EUVD-2026-93935
GHSA-6w6g-ww2r-qrcm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with connector management privileges
-
DeliveryCreate connector with oversized description field
-
ExploitAccess resource to trigger allocation
-
ExecutionExhaust node heap memory
-
ImpactCrash affected node (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory allocation limits
|
| Exploitation Conditions | Exploitation requires an authenticated account that holds connector management privileges (PR:L) and reachability to the Elasticsearch connector API over the network; it is not available to anonymous or unprivileged users. The specific trigger is creating a connector resource with an excessively large |
| Impact | This is a moderate-severity, authenticated denial-of-service issue that should be treated as a patch-in-normal-cycle item rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 6.5 and is internally consistent with the description: network-reachable, low attack complexity, but requiring low-level privileges (PR:L) - specifically connector management rights - with no confidentiality or integrity impact and high availability impact (node crash via heap exhaustion). No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so exploitation probability and automatability cannot be assessed from the available signals. The requirement for a legitimately authenticated and privileged connector-management user sharply limits the real-world threat population to insiders or attackers who have already obtained such credentials, which is why the impact is correctly capped at availability only. There are no conflicting signals: the vector matches the described local-privilege-plus-network-API access pattern. Overall this is a genuine but lower-priority availability risk, not a high-urgency item. |
| Exploit ScenarioDerived | An authenticated user holding connector management privileges creates a connector resource containing an excessively large |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Denial of service in Elasticsearch lets an authenticated user who holds connector management privileges exhaust node heap memory by creating a connector resource with an excessively large description field and then causing that resource to be accessed or read, crashing the affected node. The path is network-reachable but requires PR:L authorization, and the impact is limited to availability with no data confidentiality or integrity loss. No public exploit code has been identified at time of analysis, and Elastic has released fixed versions 8.19.2, 9.0.6, 9.1.4, and 9.2.1 in advisory ESA-2026-195.
RemediationAI
Vendor-released patches are available: upgrade to Elasticsearch 8.19.2, 9.0.6, 9.1.4, or 9.2.1 (or later in the corresponding release line) as described in advisory ESA-2026-195 at https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-195/390869. Because the trigger requires connector management privileges, the most effective interim control is least-privilege enforcement: audit connector management roles and remove them from all but a small set of trusted operators, which directly shrinks the attack surface but does not eliminate risk from a compromised authorized account. If connectors are not in use, disable or remove the connector feature or integration to eliminate the reachable API surface, accepting the trade-off that enabling connectors later requires re-enabling and re-testing. Restrict network access to the Elasticsearch HTTP and transport APIs to trusted management networks via firewall rules or a reverse proxy, which reduces the AV:N exposure but complicates legitimate remote administration. Enable audit logging on connector API calls and monitor JVM heap metrics and node-crash events to detect creation of oversized connector descriptions; note that alerting adds monitoring overhead and will not prevent the initial node crash. No vendor-issued configuration flag is documented as fully mitigating the excessive allocation, so patching remains the primary fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-789 (Memory Allocation with Excessive Size Value), a resource-exhaustion class in which a size value derived from untrusted input is used to drive a memory allocation without adequate upper-bound validation. In Elasticsearch the affected surface is the connector management API, which stores connector definitions that include a free-text description field; oversized content in that field is accepted at creation time and then used to size allocations during later reads, so heap consumption scales with the submitted input until the JVM runs out of memory. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms a network-reachable, low-complexity path that requires an authenticated account with connector-management rights, produces only availability impact, and does not cross a scope boundary. Connectors are normally used to index content from external systems, so the attack surface exists only where connector functionality is enabled and usable in the deployment.
Know when Elasticsearch gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable API (AV:N), straightforward to trigger (AC:L), but requires connector management authorization (PR:L); impact is availability-only node crash (A:H, C:N, I:N).
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
DescriptionCVE.org
Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled amount of memory when connector resources with an excessively large description field are created and subsequently accessed, exhausting available heap memory and crashing the affected node.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Elasticsearch
View allThe Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execut
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause
Maliciously crafted on-chain account names processed by Klever-Go prior to 1.7.20 are spliced into Elasticsearch _bulk r
All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. Rated medium severit
Remote code execution in Elasticsearch's machine learning component allows an authenticated user with ML model deploymen
Heap corruption and potential remote code execution in Elasticsearch's native ML inference engine can be triggered by an
The fix for CVE-2020-7009 was found to be incomplete. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker
Exploit-DB