AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

ElasticCVE-2026-94396

Elasticsearch: resource exhaustion

Elastic

CVE-2026-94396 · Published Sep 26, 2026 · updated Sep 29, 2026

Medium6.5
No fix yet
Elastic advisory

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

Affected versions

PackageAffectedFixed in
Elasticsearch
Product
>= 9.2.0, <= 9.4.6No fix yet
>= 9.5.0, <= 9.5.3No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-400

More Elastic advisories

All Elastic
Medium 6.5Sep 26Elasticsearch: resource exhaustionCVE-2026-94397no fix yetMedium 6.5Sep 26Elasticsearch: resource exhaustionCVE-2026-94398no fix yetMedium 6.5Sep 26Elasticsearch: resource exhaustionCVE-2026-94399no fix yetMedium 6.5Sep 26Elastic Kibana: resource exhaustionCVE-2026-94400no fix yetMedium 4.9Sep 26Elasticsearch: resource exhaustionCVE-2026-94408no fix yetMedium 6.3Sep 26Elastic Kibana: insecure direct object referenceCVE-2026-72662no fix yet