Advisoriesby IbisElasticCVE-2026-63136
Elasticsearch: resource exhaustion
No fix yet
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and cluster degradation. An attacker could leverage this vulnerability to cause cluster downtime requiring manual intervention to restore service.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Elasticsearch Product | >= 8.0.0, <= 8.19.14 | No fix yet |
| >= 9.3.0, <= 9.3.3 | No fix yet | |
| >= 9.0.0, <= 9.2.8 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-400