CVEvulnerability

CVE-2026-63136

6.5 MEDIUM Published 2026-07-21 Modified 2026-10-24 Official page ↗
Status
Analyzed
Published
2026-07-21
Last modified
2026-10-24
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400

Description

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and cluster degradation. An attacker could leverage this vulnerability to cause cluster downtime requiring manual intervention to restore service.

Affected configurations

• elastic elasticsearch (>= 8.0.0 < 8.19.15) • elastic elasticsearch (>= 9.0.0 < 9.2.9) • elastic elasticsearch (>= 9.3.0 < 9.3.4)

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References