Executive brief
Elasticsearch, a widely used search and analytics engine, is vulnerable to a denial-of-service attack. An authorized user can submit a specially crafted query that causes the system to consume excessive processor power. This can lead to a complete service outage for search functions until the affected system is restarted, potentially disrupting business operations and data analysis.
Technical details
A vulnerability in the Elasticsearch ES|QL engine allows for Uncontrolled Resource Consumption (CWE-400) via Exponential Data Expansion (CAPEC-197). An authenticated attacker with permissions to execute ES|QL queries can submit a crafted request that triggers exponential CPU usage during evaluation. The resource exhaustion persists even after the query is technically complete, eventually exhausting all available query worker resources. This results in a denial-of-service condition for the ES|QL engine that can only be remediated by a node restart. The issue is fixed in versions 8.19.19, 9.3.8, and 9.4.4.
Affected products
- Elastic Elasticsearch 8.0.0 to 8.19.18, 9.0.0 to 9.3.7, 9.4.0 to 9.4.3
Timeline
- 2026-07-21: advisory: Elastic published security update ESA-2026-74
- 2026-07-22: disclosed: CVE published to NVD dataset