CVE-2026-115715
Received Received - Intake

Allocation of Resources Without Limits or Throttling in Elasticsearch

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: Elastic

Description
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an affected phonetic encoder of the analysis-phonetic plugin. An authenticated user with permission to write documents to or run searches against an index that uses an affected encoder can cause an Elasticsearch node to exhaust its heap memory. The node can become unresponsive or terminate.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-115715
EUVD
EUVD-2026-116080

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Elastic Elasticsearch 8.0.0
Elastic Elasticsearch 9.0.0
Elastic Elasticsearch 9.5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch. It affects the analysis-phonetic plugin and allows an authenticated user with write or search permissions to cause a denial of service by exploiting a specially crafted input value processed by the koelnerphonetik or haasephonetik encoders. This leads to heap memory exhaustion in an Elasticsearch node, potentially making it unresponsive or terminating it.

Detection Guidance

Check if the analysis-phonetic plugin is installed and if any index uses the koelnerphonetik or haasephonetik encoders. Use Elasticsearch APIs like GET _cat/plugins?v or GET _nodes/plugins to verify plugin presence. Inspect index mappings with GET /<index>/_mapping to confirm affected encoder usage.

Impact Analysis

If you are using an affected version of Elasticsearch with the analysis-phonetic plugin and at least one index using the koelnerphonetik or haasephonetik encoders, an attacker with write or search permissions could exploit this to exhaust node memory. This may cause the node to become unresponsive or crash, leading to service disruption and potential data unavailability.

Mitigation Strategies

Upgrade Elasticsearch to versions 8.19.24, 9.4.9, or 9.5.6. If upgrading is not possible, disable the affected encoders by recreating indices with updated mappings and reindexing data. Remove or restrict access for users with write/search permissions on affected indices.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115715. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...