Uncontrolled Resource Consumption in Elasticsearch

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Elastic

Description

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and cluster degradation. An attacker could leverage this vulnerability to cause cluster downtime requiring manual intervention to restore service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-63136

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is an uncontrolled resource consumption issue in Elasticsearch where a user with search privileges can submit a specially crafted search request. This causes a data node to exhaust available heap memory, leading to node unavailability and cluster degradation.

Impact Analysis

An attacker could exploit this to cause cluster downtime, requiring manual intervention to restore service. This results in service disruption and potential data unavailability for users relying on the Elasticsearch cluster.

Mitigation Strategies

Limit user privileges to prevent excessive search requests. Monitor heap memory usage on data nodes for unusual spikes. Apply Elasticsearch updates or patches if available. Consider enabling circuit breakers to restrict resource consumption.

Hi! I’m here to help you understand CVE-2026-63136. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70