CVE-2026-63263

Analyzed Analyzed - Analysis Complete

Uncontrolled Resource Consumption in Elasticsearch via Exponential Data Expansion

Publication date: 2026-07-22

Last updated on: 2026-08-03

Assigner: Elastic

Description

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource exhaustion persists beyond query completion, repeated requests can fully exhaust the available query worker resources, rendering ES|QL queries unavailable until the node is restarted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-08-03

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-63263

EUVD

EUVD-2026-47591

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	From 8.0.0 (inc) to 8.19.19 (exc)
elastic	elasticsearch	From 9.0.0 (inc) to 9.3.8 (exc)
elastic	elasticsearch	From 9.4.0 (inc) to 9.4.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

CVE-2026-63263 is an uncontrolled resource consumption vulnerability in Elasticsearch that allows denial of service via exponential data expansion. An authenticated user can submit a specially crafted query to the ES|QL engine, causing exponential CPU usage during evaluation. The resource exhaustion persists even after query completion, and repeated requests can fully deplete query worker resources, making ES|QL queries unavailable until the node is restarted.

Detection Guidance

Monitor CPU usage spikes during ES|QL query execution. Check Elasticsearch logs for repeated failed or slow ES|QL queries. Use system monitoring tools like top, htop, or Elasticsearch's own monitoring APIs to detect abnormal resource consumption patterns.

Impact Analysis

This vulnerability can impact you by causing system downtime and degraded performance. If exploited, it may render ES|QL queries unavailable until the affected Elasticsearch node is restarted. Organizations relying on Elasticsearch for critical operations could face service disruptions, increased operational costs, and potential data processing delays.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt system availability. GDPR requires maintaining data processing integrity and availability, while HIPAA mandates ensuring access to protected health information. A DoS condition may violate these requirements by preventing authorized access to systems handling sensitive data.

Mitigation Strategies

Upgrade Elasticsearch to versions 8.19.19, 9.3.8, or 9.4.4 or later. If upgrading is not possible, restrict access to ES|QL query execution for untrusted users. Monitor and limit query complexity to prevent excessive CPU consumption.

Hi! I’m here to help you understand CVE-2026-63263. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70