Is CVE-2026-82300 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82300 being exploited in the wild.

How severe is CVE-2026-82300?

Medium severity, with a CVSS score of 6.5, published 26 September 2026.

Which products and versions are affected?

Elasticsearch 8.0.0–8.19.21, 9.0.0–9.4.6, 9.5.0–9.5.3.

Is there a fix for CVE-2026-82300?

A patch was published on 2026-09-25: Versions 8.19.22, 9.4.7, 9.5.4 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82300 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82300?

Check whether you run Elasticsearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82300: Elasticsearch uncontrolled resource consumption denial of service

CVE-2026-82300 · Severity: medium · CVSS 6.5 · Published 2026-09-26

Elasticsearch, a search and analytics engine used to index and search large datasets, contains a flaw that allows authenticated users to consume excessive server resources through the index analysis APIs, resulting in service disruption. An attacker with valid credentials can trigger this vulnerability to crash or severely degrade the search service, impacting business applications that depend on it for data retrieval and analytics.

Technologies: Elasticsearch. Vendors: Elastic.

Quick answers

Is CVE-2026-82300 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82300 being exploited in the wild.
How severe is CVE-2026-82300?: Medium severity, with a CVSS score of 6.5, published 26 September 2026.
Which products and versions are affected?: Elasticsearch 8.0.0–8.19.21, 9.0.0–9.4.6, 9.5.0–9.5.3.
Is there a fix for CVE-2026-82300?: A patch was published on 2026-09-25: Versions 8.19.22, 9.4.7, 9.5.4 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82300 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82300?: Check whether you run Elasticsearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An uncontrolled resource consumption vulnerability (CWE-400) exists in Elasticsearch's index analysis APIs. Authenticated users with privileges to invoke these APIs can trigger excessive memory or CPU allocation, leading to denial of service. The vulnerability affects versions 8.0.0–8.19.21, 9.0.0–9.4.6, and 9.5.0–9.5.3, and is resolved in 8.19.22, 9.4.7, and 9.5.4.

Affected products

Elastic Elasticsearch 8.0.0–8.19.21, 9.0.0–9.4.6, 9.5.0–9.5.3

Timeline

2026-09-25: disclosed: ESA-2026-176 security advisory published
2026-09-25: patched: Versions 8.19.22, 9.4.7, 9.5.4 released with fix

References

https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-176/390682

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.