CVE-2026-63136

Awaiting Analysis Awaiting Analysis - Queue

Uncontrolled Resource Consumption in Elasticsearch

Publication date: 2026-07-21

Last updated on: 2026-08-07

Assigner: Elastic

Description

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and cluster degradation. An attacker could leverage this vulnerability to cause cluster downtime requiring manual intervention to restore service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-07

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-63136

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	From 8.0.0 (inc) to 8.19.15 (exc)
elastic	elasticsearch	From 9.0.0 (inc) to 9.2.9 (exc)
elastic	elasticsearch	From 9.3.0 (inc) to 9.3.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is an uncontrolled resource consumption issue in Elasticsearch where a user with search privileges can submit a specially crafted search request. This causes a data node to exhaust available heap memory, leading to node unavailability and cluster degradation.

Detection Guidance

Detecting uncontrolled resource consumption in Elasticsearch requires monitoring heap memory usage and search request patterns. Check Elasticsearch logs for high memory consumption or node failures. Use the Elasticsearch API to query node stats: curl -X GET 'localhost:9200/_nodes/stats/jvm?pretty'. Monitor for heap usage approaching 100% or frequent garbage collection pauses.

Impact Analysis

An attacker could exploit this to cause cluster downtime, requiring manual intervention to restore service. This results in service disruption and potential data unavailability for users relying on the Elasticsearch cluster.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing service disruptions due to denial of service. GDPR requires data availability and integrity, while HIPAA mandates system availability for protected health information. Cluster downtime may lead to unauthorized data access risks or service unavailability, violating these standards.

Mitigation Strategies

Limit user privileges to prevent excessive search requests. Monitor heap memory usage on data nodes for unusual spikes. Apply Elasticsearch updates or patches if available. Consider enabling circuit breakers to restrict resource consumption.

Hi! I’m here to help you understand CVE-2026-63136. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70