# CVE-2026-94397: Elasticsearch uncontrolled resource consumption denial of service

Source: https://junglewise.ai/threats/cve-2026-94397-uncontrolled-resource-consumption-cwe-400-in-elasticsearch-can  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-94397 · Severity: medium · CVSS 6.5 · Published 2026-09-26

Elasticsearch, a widely-used search and analytics engine, contains a resource consumption flaw that allows authenticated attackers to exhaust server memory or CPU and take the service offline. An attacker with valid credentials can trigger excessive resource allocation, causing a denial of service that impacts availability for all users and applications relying on the database.

Technologies: [Elasticsearch](https://junglewise.ai/threats/technologies/elasticsearch). Vendors: [Elastic](https://junglewise.ai/threats/vendors/elastic).

## Quick answers

**Is CVE-2026-94397 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94397 being exploited in the wild.

**How severe is CVE-2026-94397?** Medium severity, with a CVSS score of 6.5, published 26 September 2026.

**Which products and versions are affected?** Elasticsearch 8.0.0 to 8.19.21; 9.0.0 to 9.4.6; 9.5.0 to 9.5.3.

**Is there a fix for CVE-2026-94397?** A patch was published on 2026-09-25. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-94397 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-94397?** Check whether you run Elasticsearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An uncontrolled resource consumption vulnerability (CWE-400) in Elasticsearch allows authenticated users to trigger excessive allocation of system resources (CAPEC-130), leading to denial of service. The vulnerability requires valid credentials (PR:L in the CVSS vector) and network access; once exploited, an attacker can exhaust available memory or CPU to crash the service. The issue is resolved in versions 8.19.22, 9.4.7, and 9.5.4 or later.

## Affected products

- Elastic Elasticsearch 8.0.0 to 8.19.21; 9.0.0 to 9.4.6; 9.5.0 to 9.5.3

## Timeline

- 2026-09-26: disclosed
- 2026-09-25: patched

## References

- [https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-183/390687](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-183/390687)

## Related threats

- [Elasticsearch denial of service in phonetic analysis encoders](https://junglewise.ai/threats/cve-2026-115715-allocation-of-resources-without-limits-or-throttling-cwe-770-in)
- [Elasticsearch cache information disclosure via field-level security bypass](https://junglewise.ai/threats/cve-2026-115710-use-of-cache-containing-sensitive-information-cwe-524-in)
- [Elasticsearch incorrect authorization in field-level security](https://junglewise.ai/threats/cve-2026-115298-incorrect-authorization-cwe-863-in-elasticsearch-can-lead-to)
- [Elasticsearch uncontrolled recursion denial of service](https://junglewise.ai/threats/cve-2026-115290-uncontrolled-recursion-cwe-674-in-elasticsearch-can-lead-to)
- [Elasticsearch authorization bypass in cross-cluster search](https://junglewise.ai/threats/cve-2026-103009-authorization-bypass-through-user-controlled-key-cwe-639-in)