CVE-2026-94399

Received Received - Intake

Uncontrolled Resource Consumption in Elasticsearch

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: Elastic

Description

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-26

Last Modified

2026-09-26

Generated

2026-09-27

AI Q&A

2026-09-27

EPSS Evaluated

N/A

NVD

CVE-2026-94399

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is an uncontrolled resource consumption issue in Elasticsearch that can lead to denial of service through excessive allocation. It is classified under CWE-400 and CAPEC-130, meaning attackers can exploit it to consume excessive system resources, making services unavailable.

Impact Analysis

This vulnerability can cause service disruptions by consuming excessive resources, leading to downtime or degraded performance for Elasticsearch instances. It may affect availability of data and applications relying on Elasticsearch.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial of service attacks, potentially disrupting data availability and integrity. GDPR requires ensuring data availability and security, while HIPAA mandates protecting health information against unauthorized access or disruption. Exploitation of this flaw may lead to service unavailability, violating these requirements.

Mitigation Strategies

Update Elasticsearch to the latest patched version immediately to address uncontrolled resource consumption risks. Monitor system resources for unusual spikes in CPU, memory, or disk usage that may indicate exploitation attempts. Restrict network access to Elasticsearch instances by configuring firewalls or using private networks to limit exposure.

Hi! I’m here to help you understand CVE-2026-94399. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70