# CVE-2026-94398: Elasticsearch uncontrolled resource consumption denial of service

Source: https://junglewise.ai/threats/cve-2026-94398-uncontrolled-resource-consumption-cwe-400-in-elasticsearch-can  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-94398 · Severity: medium · CVSS 6.5 · Published 2026-09-26

Elasticsearch, a widely-used search and analytics engine, contains a resource consumption vulnerability that allows an authenticated attacker to trigger excessive memory or CPU allocation. An attacker could exploit this to cause a denial of service, making the search service unavailable to legitimate users and disrupting business operations that depend on real-time data indexing and retrieval.

Technologies: [Elasticsearch](https://junglewise.ai/threats/technologies/elasticsearch). Vendors: [Elastic](https://junglewise.ai/threats/vendors/elastic).

## Quick answers

**Is CVE-2026-94398 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94398 being exploited in the wild.

**How severe is CVE-2026-94398?** Medium severity, with a CVSS score of 6.5, published 26 September 2026.

**Which products and versions are affected?** Elasticsearch 8.12.0 to 8.19.21; 9.0.0 to 9.4.6; 9.5.0 to 9.5.3.

**Is there a fix for CVE-2026-94398?** A patch was published on 2026-09-25: Fixed in Elasticsearch 8.19.22, 9.4.7, 9.5.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-94398 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-94398?** Check whether you run Elasticsearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An uncontrolled resource consumption flaw (CWE-400) in Elasticsearch allows authenticated users to trigger excessive allocation of system resources (CAPEC-130), leading to denial of service. The vulnerability requires valid authentication credentials and network access to the Elasticsearch API. Versions 8.12.0–8.19.21, 9.0.0–9.4.6, and 9.5.0–9.5.3 are affected; patches are available in versions 8.19.22, 9.4.7, and 9.5.4.

## Affected products

- Elastic Elasticsearch 8.12.0 to 8.19.21; 9.0.0 to 9.4.6; 9.5.0 to 9.5.3

## Timeline

- 2026-09-26: disclosed: CVE-2026-94398 published
- 2026-09-25: patched: Fixed in Elasticsearch 8.19.22, 9.4.7, 9.5.4

## References

- [https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-179/390683](https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-179/390683)

## Related threats

- [Elasticsearch denial of service in phonetic analysis encoders](https://junglewise.ai/threats/cve-2026-115715-allocation-of-resources-without-limits-or-throttling-cwe-770-in)
- [Elasticsearch cache information disclosure via field-level security bypass](https://junglewise.ai/threats/cve-2026-115710-use-of-cache-containing-sensitive-information-cwe-524-in)
- [Elasticsearch incorrect authorization in field-level security](https://junglewise.ai/threats/cve-2026-115298-incorrect-authorization-cwe-863-in-elasticsearch-can-lead-to)
- [Elasticsearch uncontrolled recursion denial of service](https://junglewise.ai/threats/cve-2026-115290-uncontrolled-recursion-cwe-674-in-elasticsearch-can-lead-to)
- [Elasticsearch authorization bypass in cross-cluster search](https://junglewise.ai/threats/cve-2026-103009-authorization-bypass-through-user-controlled-key-cwe-639-in)