Executive brief
Elasticsearch, a search and analytics engine used to index and search large datasets, contains a flaw that allows authenticated users to consume excessive server resources through the index analysis APIs, resulting in service disruption. An attacker with valid credentials can trigger this vulnerability to crash or severely degrade the search service, impacting business applications that depend on it for data retrieval and analytics.
Technical details
An uncontrolled resource consumption vulnerability (CWE-400) exists in Elasticsearch's index analysis APIs. Authenticated users with privileges to invoke these APIs can trigger excessive memory or CPU allocation, leading to denial of service. The vulnerability affects versions 8.0.0–8.19.21, 9.0.0–9.4.6, and 9.5.0–9.5.3, and is resolved in 8.19.22, 9.4.7, and 9.5.4.
Affected products
- Elastic Elasticsearch 8.0.0–8.19.21, 9.0.0–9.4.6, 9.5.0–9.5.3
Timeline
- 2026-09-25: disclosed: ESA-2026-176 security advisory published
- 2026-09-25: patched: Versions 8.19.22, 9.4.7, 9.5.4 released with fix