Executive brief
Elasticsearch, a widely-used search and analytics engine, contains a resource consumption flaw that allows authenticated attackers to exhaust server memory or CPU and take the service offline. An attacker with valid credentials can trigger excessive resource allocation, causing a denial of service that impacts availability for all users and applications relying on the database.
Technical details
An uncontrolled resource consumption vulnerability (CWE-400) in Elasticsearch allows authenticated users to trigger excessive allocation of system resources (CAPEC-130), leading to denial of service. The vulnerability requires valid credentials (PR:L in the CVSS vector) and network access; once exploited, an attacker can exhaust available memory or CPU to crash the service. The issue is resolved in versions 8.19.22, 9.4.7, and 9.5.4 or later.
Affected products
- Elastic Elasticsearch 8.0.0 to 8.19.21; 9.0.0 to 9.4.6; 9.5.0 to 9.5.3
Timeline
- 2026-09-26: disclosed
- 2026-09-25: patched