CVE-2026-94397

Received Received - Intake

Uncontrolled Resource Consumption in Elasticsearch

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: Elastic

Description

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-26

Last Modified

2026-09-26

Generated

2026-09-27

AI Q&A

2026-09-27

EPSS Evaluated

N/A

NVD

CVE-2026-94397

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability in Elasticsearch is caused by uncontrolled resource consumption, specifically excessive allocation of resources. It can lead to a denial of service condition where the system becomes unavailable due to resource exhaustion.

Impact Analysis

This vulnerability can impact you by causing your Elasticsearch service to become unresponsive or crash, leading to downtime and potential loss of access to critical data and services.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing service disruptions due to denial of service, potentially leading to unauthorized data access or processing delays. Uncontrolled resource consumption may violate availability requirements in these regulations.

Mitigation Strategies

Update Elasticsearch to the latest patched version immediately to address uncontrolled resource consumption. Monitor system resources for unusual spikes in CPU, memory, or disk usage. Restrict network access to Elasticsearch instances and implement rate limiting to prevent excessive allocation attempts.

Hi! I’m here to help you understand CVE-2026-94397. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70